Weave Code
Php Authenticator Laravel Package
chillerlan/php-authenticator
A PHP 8.4+ library for generating counter-based (RFC 4226) and time-based (RFC 6238) one-time passwords, compatible with Google Authenticator and Steam Guard, with constant-time encoding and server time sync support.
chillerlan/php-authenticator is a PHP library for generating counter-based (RFC 4226, HOTP) and time-based (RFC 6238, TOTP) one-time passwords, offering a modern Google Authenticator-compatible 2FA implementation. It targets PHP 8.4+ and supports constant-time encoding through ext-sodium when available.
- Generate HOTP and TOTP codes from shared secrets
- Google Authenticator-compatible provisioning URIs
- Steam Guard support with server time synchronization
- Configurable HMAC algorithms, digits, and time periods
- Secure base32/hex handling with constant-time fallbacks
Frequently asked questions about Php Authenticator
- How do I install chillerlan/php-authenticator in a Laravel app?
- Run composer require chillerlan/php-authenticator. It is a framework-agnostic leaf dependency, so there is no service provider, facade, config publishing, or migration to register. Wrap it behind your own service or interface rather than calling Authenticator directly from controllers.
- Does chillerlan/php-authenticator support Laravel 10, 11, and 12?
- The package has no Laravel coupling, so it composes into Laravel 10, 11, and 12 as long as your PHP version matches. v6 requires PHP 8.4 or newer; if your Laravel app runs PHP 8.2 or 8.3, pin ^5.4 instead. Check your production PHP version before choosing a release.
- What PHP version does chillerlan/php-authenticator require?
- Version 6.0.0 requires PHP 8.4 or newer. Earlier 5.x releases work on PHP 8.2 and 8.3, so pinning ^5.4 is a low-cost way to defer a platform upgrade. The v6 breaking change is essentially the PHP floor plus dependency bumps.
- How do I generate a TOTP secret and otpauth URI for Google Authenticator?
- Use createSecret() to generate the secret and getUri() to build the otpauth:// provisioning URI. The package returns only the URI, not a QR image, so render the QR code yourself in your Laravel UI. Snapshot-test the generated URI string because authenticator apps vary in which optional parameters they honour.
- Does chillerlan/php-authenticator prevent OTP replay attacks?
- No. verify() checks an adjacent time window, defaulting to one step of roughly 30 seconds of code reuse, but it does not track consumed codes. Persist a last_used_step per user and reject any step less than or equal to the stored value. For HOTP, the counter is supplied by the caller, so atomic increment under concurrent logins is your responsibility.
- How should I store and encrypt 2FA secrets in Laravel?
- The package does nothing about at-rest encryption; getSecret() returns Base32 and getRawSecret() returns the binary form. Encrypt secrets with Laravel's encrypter or a KMS-backed key, and document key custody and rotation. Secret persistence, recovery codes, rate limiting, audit logging, and admin reset are first-party scope, not package features.
- Can I use chillerlan/php-authenticator for Steam Guard?
- Yes, it supports counter-based HOTP and Steam Guard, and Steam Guard time synchronization can use ext-curl. Do not put a remote time fetch in the authentication hot path; prefer NTP and only keep the curl path if Steam Guard is genuinely in scope.
- How do I test chillerlan/php-authenticator against RFC test vectors?
- Verification is trivially testable against the published RFC 4226 and RFC 6238 test vectors. Do this before writing any product code and keep conformance tests in your own suite regardless of the package version. Also wrap construction and verification defensively, because the README does not define exception behaviour for malformed secrets or invalid options.
- What are alternatives to chillerlan/php-authenticator for Laravel 2FA?
- Common alternatives include pragmarx/google2fa and otphp, which cover similar TOTP and HOTP primitives. The package exposes a small API surface around createSecret, setSecret/getSecret, code, verify, and getUri, so wrapping it behind an interface makes a vendor swap a contained change. Forking is also viable because it is MIT licensed.
- Is chillerlan/php-authenticator actively maintained and safe for production?
- It is MIT licensed with a single maintainer, around 56 stars, and no dependents, so ecosystem validation is weak and there is no bus factor. The API is small enough to fork and vendor in a day, and you should own conformance tests regardless. Pin a known version in composer.lock and assess the maintenance risk before committing.
Weaver
How can I help you explore Laravel packages today?