TwoFactorAuth

TwoFactorAuth is a PHP library implementing Time-based One-Time Password (TOTP) two-factor authentication, compatible with Google Authenticator and similar apps. It generates and validates TOTP codes, produces otpauth:// provisioning URIs, and renders QR codes for enrollment via pluggable QR-code providers (Endroid QR Code, BaconQrCode, or external HTTP-based services).

Built as an explicit improvement on the older PHPGangsta/GoogleAuthenticator library, it separates concerns into swappable Qr, Rng (random number generation), and Time provider interfaces, letting applications supply their own QR rendering backend, entropy source, or NTP-based time sync without forking the core TOTP logic. It requires PHP >=8.2 and has no hard runtime dependencies — QR and time providers are opt-in via Composer’s suggest.

What You Get

• TwoFactorAuth class for generating shared secrets, verifying submitted TOTP codes (with configurable time-window tolerance), and building otpauth:// provisioning URIs
• Pluggable Qr\IQRCodeProvider implementations (Endroid QR Code, BaconQrCode, or external services like QRServer/ImageCharts) for rendering enrollment QR codes
• Pluggable Rng\IRNGProvider implementations for the random secret generation entropy source
• Pluggable Time\ITimeProvider implementations, including an NTPTimeProvider for clock-drift-resistant TOTP validation
• Configurable algorithm (SHA1/SHA256/SHA512), code digit count, and time-step period per the RFC 6238 TOTP spec

Common Use Cases

• Adding Google Authenticator-compatible 2FA login to a PHP application’s account security settings
• Rendering a QR code enrollment screen so users can scan a shared secret into their authenticator app
• Validating TOTP codes server-side during login with tolerance for minor clock drift between client and server
• Building custom 2FA flows in CakePHP, CodeIgniter, or other PHP frameworks via existing community integrations

Under The Hood

Architecture - The core TwoFactorAuth.php class implements RFC 6238 TOTP generation/validation and RFC 4226 HOTP counters, delegating QR code rendering to injected Providers\Qr\* implementations, secret generation entropy to Providers\Rng\*, and current-time lookups to Providers\Time\* — a strategy-pattern design that keeps the TOTP math decoupled from any specific QR library or time source. Tech Stack - Pure PHP 8.2+ with zero hard runtime dependencies; QR rendering optionally pulls in endroid/qr-code or bacon/bacon-qr-code per Composer’s suggest block, and code quality is enforced via PHPStan and PHP-CS-Fixer. Code Quality - The tests/ directory (PHPUnit, with a Providers/ subtree mirroring the source layout) covers the TOTP algorithm and provider implementations, run under Xdebug coverage in CI, though the project’s recent commit activity is low relative to its 2014 creation date and 27 tagged releases. API Design - A single TwoFactorAuth constructor accepts optional provider instances (falling back to sensible defaults), keeping the common case (‘create a secret, verify a code’) to a couple of method calls while still allowing full provider substitution for advanced use.