One-time passwords in PHP, the six digits your users copy from their phone. Two algorithms, no dependency on any vendor, and the same codes every authenticator app already knows how to read.
What it covers
- TOTP, RFC 6238: a code derived from the current time, valid for a short window. This is what almost every application means by two-factor authentication.
- HOTP, RFC 4226: a code derived from a counter, incremented at each use. Useful when there is no reliable clock on either side.
- Provisioning URIs, the
otpauth://string behind the QR code your users scan to enrol a device. - Verification with leeway, so a code typed a few seconds late still works without widening the window for everyone.
The codes are compatible with Google Authenticator, FreeOTP and the other authenticator applications: the point of a standard is that no one has to know which one your user picked.
Getting started
composer require spomky-labs/otphpPHP 8.1 or later. The library has three dependencies and none of them talk to the network.
One thing worth knowing: the clock
A time-based code is only as trustworthy as the clock that produced it. Since 11.4 the library accepts a PSR-20 clock, and from version 12 it will require one. Passing your own clock is not ceremony: it is what lets you test the expiry of a code without waiting thirty seconds, and what stops a drifting server from rejecting codes that were correct.
If you are wondering what those six digits actually are, there is an article about it.
Where to look next
The documentation lives in the repository and walks through both algorithms with working examples. The source is on GitHub, under the MIT licence.