Google2FA

Google2FA is a PHP library implementing the HMAC-based One-Time Password (HOTP, RFC 4226) and Time-based One-Time Password (TOTP, RFC 6238) algorithms used by Google Authenticator, Authy, and most other two-factor-authentication apps. It handles secret-key generation, code generation, and code verification with configurable window tolerance for clock drift, without depending on any particular web framework.

Because the core library has no framework dependencies, it’s usable directly in plain PHP or through companion packages that add Laravel-specific integration (config, middleware, QR-code rendering) on top. It’s one of the most widely deployed 2FA libraries in the PHP ecosystem, commonly pulled in as a dependency of Laravel authentication starter kits and admin panels.

What You Get

• TOTP (time-based) and HOTP (counter-based) one-time password generation per RFC 6238 and RFC 4226
• Secret key generation compatible with Google Authenticator, Authy, and other standard TOTP apps
• Configurable verification window to tolerate clock drift between server and authenticator device
• Framework-agnostic core with no hard dependency on Laravel or any other framework
• QR code helper utilities for rendering the secret as a scannable enrollment code

Common Use Cases

• Adding two-factor authentication to a login flow using an app like Google Authenticator or Authy
• Implementing 2FA in a Laravel application via companion packages built on this core library
• Building custom admin-panel or account-security features requiring TOTP/HOTP verification
• Generating and validating one-time passwords in non-Laravel PHP applications or APIs

Under The Hood

Architecture: The entire public API is exposed through a single Google2FA.php class in src/, which composes helper traits/classes from src/Support/ for base32 encoding, secret generation, and code computation, keeping the library’s surface deliberately small and centered on one responsibility — computing and verifying OTP codes. Exceptions/ provides typed exceptions for invalid secrets or characters, so calling code can distinguish configuration errors from failed verification.

Tech Stack: It’s a compact, dependency-light PHP library (only 19 PHP files total) requiring PHP 7.4+/8.0+, with no framework binding — Laravel-specific behavior (config publishing, QR rendering, middleware) lives in the separate pragmarx/google2fa-laravel and bacon/bacon-qr-code-based companion packages rather than in this core repo.

Code Quality: Test coverage is tracked via Codecov and CI runs both a PHPUnit workflow and a dedicated static-analysis workflow on every push, giving confidence in the cryptographic correctness of the core algorithm despite the small file count. Maintenance has slowed in recent history (release_frequency ~0.02/week) even though the library remains a widely-depended-upon foundation for PHP 2FA.

API Design: Usage is minimal — Google2FA::generateSecretKey() and Google2FA::verifyKey($secret, $code) cover the two core operations most integrations need, with sensible defaults for window tolerance, so a working 2FA flow can be wired up in a handful of lines without reading deep documentation.