mincdev/php-otpauth

PHP library for Time-based One-Time Password (TOTP) authentication compatible with Google Authenticator, Microsoft Authenticator and Authy.

v2.0.0 2026-07-13 09:02 UTC

Requires

• php: ^8.2 || ^8.3 || ^8.4
• tecnickcom/tc-lib-barcode: ^2.11

Requires (Dev)

• phpunit/phpunit: ^11.0

MIT

• Christopher Smit

• security
• two-factor
• otp
• totp
• authenticator
• 2fa
• google-authenticator

Published on Packagist.org on 2026-07-13 09:03 UTC

README

A lightweight PHP library for generating and validating Time-based One-Time Passwords (TOTP) compatible with Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and other RFC 6238 compatible authenticator applications.

Features

• 🔒 Generate cryptographically secure TOTP secrets
• 📱 Generate QR codes for easy authenticator app provisioning
• ✅ Validate one-time passwords
• 🧪 Verified against the official RFC 6238 test vectors
• 🖥️ QR codes are generated locally on your server — no secrets are sent to third-party services
• 🚀 Lightweight with minimal dependencies

Installation

Install the package using Composer:

composer require mincdev/php-otpauth

Generating a Secret and QR Code

use MincDev\OtpAuth\OtpAuthenticator;

$otp = new OtpAuthenticator();

// Store the secret securely for the user.
$secret = $otp->newSecret();

$qrCode = $otp->getQR(
    '[e-mail]',
    'My Awesome App',
    $secret
);

The returned value is a Base64 data URI that can be used directly in an image tag:

<img src="<?= $qrCode ?>" alt="Authenticator QR Code">

Validating a Code

use MincDev\OtpAuth\OtpAuthenticator;

$otp = new OtpAuthenticator();

$isValid = $otp->validate($secret, $userEnteredCode);

Security

This library generates QR codes entirely on your server. The user's secret is never transmitted to an external QR code generation service, ensuring that sensitive authentication data remains under your control.

QR code generation is powered by tc-lib-barcode.

Compatibility

This library implements RFC 6238 (TOTP) and works with applications such as:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password
• Bitwarden
• and other compatible authenticator apps.

Testing

The TOTP implementation is verified against the official RFC 6238 test vectors to ensure standards-compliant code generation.

Run the test suite with:

composer test

License

Released under the MIT License.