Spomky-Labs
Welcome
Spomky-Labs builds free, libre and open source PHP libraries for security and data protection. Cryptography, authentication, and the standards that hold them together.
The libraries are used in production by thousands of applications. They are released under the MIT licence, documented, and maintained in the open on GitHub.
Behind them is Florent Morselli, a French developer who has been writing and maintaining these tools since 2014. Beyond the code, Spomky-Labs answers questions, reviews architectures, and helps teams get authentication and cryptography right the first time.
Managing smart projects
Main Projects
Three libraries carry most of the usage. Star counts and last activity are taken from GitHub.
OTPHP
Generate and verify one-time passwords in PHP, following RFC 4226 for HOTP and RFC 6238 for TOTP. Compatible with Google Authenticator, FreeOTP and the other authenticator applications.
JWT-Framework
A complete implementation of the JOSE family: JSON Web Signature, JSON Web Encryption, JSON Web Key and JSON Web Token. Every concept in the specifications has a PHP class behind it, with a Symfony bundle for integration.
Webauthn-Framework
Passwords are not enough. Webauthn lets your users authenticate with a security key, a fingerprint or their device itself. This framework brings that to PHP, with a Symfony bundle and a Stimulus component for the browser side.
And a few more
pwa-bundle for progressive web app manifests, cbor-php for CBOR encoding, web-push for push notifications, base64url, aes-key-wrap, php-aes-gcm, pki-framework. All of them on the Spomky-Labs organisation.