Welcome
Spomky-Labs builds free, libre and open source PHP libraries for security and data protection. Cryptography, authentication, and the standards that hold them together.
The libraries are used in production by thousands of applications. They are released under the MIT licence, documented, and maintained in the open on GitHub.
Behind them is Florent Morselli, a French developer who has been writing and maintaining these tools since 2014. Beyond the code, Spomky-Labs answers questions, reviews architectures, and helps teams get authentication and cryptography right the first time.
Main Projects
Three libraries carry most of the usage. Star counts and last activity are taken from GitHub.
OTPHP
Generate and verify one-time passwords in PHP, following RFC 4226 for HOTP and RFC 6238 for TOTP. Compatible with Google Authenticator, FreeOTP and the other authenticator applications.
JWT-Framework
A complete implementation of the JOSE family: JSON Web Signature, JSON Web Encryption, JSON Web Key and JSON Web Token. Every concept in the specifications has a PHP class behind it, with a Symfony bundle for integration.
Webauthn-Framework
Passwords are not enough. Webauthn lets your users authenticate with a security key, a fingerprint or their device itself. This framework brings that to PHP, with a Symfony bundle and a Stimulus component for the browser side.
And a few more
pwa-bundle for progressive web app manifests, cbor-php for CBOR encoding, web-push for push notifications, base64url, aes-key-wrap, php-aes-gcm, pki-framework. All of them on the Spomky-Labs organisation.
Last news
-
What a service worker must never cache
Caching the wrong response does not produce an error. It produces a wrong answer, delivered confidently, for as long as the cache lives.
-
Making a Symfony application installable, without a framework for it
A progressive web app needs a manifest, a service worker and a few icons. Most of the work is deciding what should happen offline.
-
Web push notifications from PHP, without a service in between
A push subscription is a URL, a public key and a secret. Everything else is your server talking directly to the browser vendor.
-
What the six digits of a TOTP code actually are
A time-based one-time password is a truncated HMAC of the current half-minute. Understanding that explains every design decision you have to make around it.
-
Certificates in PHP, or what ASN.1 asks of you
X.509 is a data structure before it is a trust model. Reading one properly means meeting ASN.1, DER, and a few decisions made in 1988.
-
Passkeys: what actually changes for your PHP application
Passkeys are Webauthn credentials that sync. That single difference changes your data model, your recovery flow and what you can promise your users.