spomky-labs / otphp

11.5.1 2026-11-07 17:39 UTC

Requires

• php: >=8.1
• paragonie/constant_time_encoding: ^2.0 || ^3.0
• psr/clock: ^1.0
• symfony/deprecation-contracts: ^3.2

Requires (Dev)

• symfony/error-handler: ^6.4|^7.0|^8.0

MIT

• Florent Morselli
• All contributors

• google authenticator
• otp
• hotp
• totp
• RFC 6238
• RFC 4226
• FreeOTP

Published on Packagist.org on 2026-11-07 17:56 UTC

README

TOTP and HOTP one-time passwords.

A php library for generating one-time passwords according to RFC 4226 (HOTP Algorithm) and RFC 6238 (TOTP Algorithm)

This library is compatible with Google Authenticator apps available for Android and iPhone. It is also compatible with other applications such as FreeOTP for example.

Documentation

The documentation is at https://docs.spomky-labs.com/otphp/, one version per maintained branch.

• Installation — and the PSR-20 clock a TOTP needs.
• TOTP or HOTP? — you almost certainly want TOTP.
• What to store — read this before designing your table.
• Security recommendations — replay, rate limiting, the secret at rest.
• From v11 to v12 — the clock, the setters, and the digests now refused.

Support

I bring solutions to your problems and answer your questions.

If you really love that project, and the work I have done or if you want I prioritize your issues, then you can help me out for a couple of 🍻 or more!

Become a sponsor

Or

Contributing

Requests for new features, bug fixes and all other ideas to make this project useful are welcome.

Please report all issues in the repository bug tracker.

Also make sure to follow these best practices.

Licence

This software is release under the MIT licence.