Laragear TwoFactor

Laragear TwoFactor is a Laravel package that adds on-premises, TOTP-based two-factor authentication to your application without relying on external APIs. It uses standard 6-digit time-based one-time password codes compatible with authenticator apps like Google Authenticator and Authy, and integrates with Laravel’s authentication flow through a simple Auth2FA facade.

The package provides everything needed to enable 2FA for your users out of the box: an authenticatable contract and trait, QR code and shared-secret generation, single-use recovery codes, throttled confirmation controllers and middleware, safe-device support, and events for enabling, disabling, and depleting recovery codes.

What You Get

• TOTP authentication with 6-digit codes compatible with common authenticator apps
• An Auth2FA facade and authenticatable contract/trait to add 2FA to user models
• QR code and shared-secret generation for enrolling devices
• Single-use recovery codes with regeneration and depletion events
• Middleware and throttled controllers for confirming and requiring 2FA
• Safe-device support so trusted devices can skip repeated challenges

Common Use Cases

• Adding two-factor authentication to a Laravel application’s login flow
• Letting users enroll authenticator apps via QR codes
• Issuing and managing recovery codes for account recovery
• Requiring a confirmed second factor before accessing sensitive routes

Under The Hood

Architecture - The package registers via TwoFactorServiceProvider and centers on the TwoFactorAuthentication model plus a TwoFactorAuthenticatable contract/trait attached to the user model. The Auth2FA facade and TwoFactorLoginHelper drive the login challenge, while Http controllers and middleware handle confirmation and throttling, Rules validate codes, and Events fire on enable/disable and recovery-code lifecycle changes.

Tech Stack - Written in PHP 8.3+ targeting Laravel 12, distributed through Composer. It ships migrations under database, translation files under lang, publishable config and views under config/resources, and a console install command, following standard Laravel package conventions.

Code Quality - The repository includes a tests directory, a phpunit.xml configuration, and PHPStan static analysis via phpstan.neon, indicating attention to correctness and type safety. Concerns are cleanly separated into Console, Contracts, Events, Exceptions, Facades, Http, Models, and Rules directories.

API Design - The developer experience is idiomatic Laravel: add a trait to the user model, run the install command, and call Auth2FA::attempt in the login controller. Recovery codes, safe devices, and middleware are opt-in, and events provide clean extension points, so common setups require very little code.