PHPackages covaleski/otp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. covaleski/otp ActiveLibrary[Security](/categories/security) covaleski/otp ============= One-time password generation. v1.1.0(2y ago)015MITPHP Since Oct 23Pushed 2y ago1 watchersCompare [ Source](https://github.com/covaleski/otp)[ Packagist](https://packagist.org/packages/covaleski/otp)[ RSS](/packages/covaleski-otp/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (2)Dependencies (3)Versions (3)Used By (0) OTP === [](#otp) [![License: MIT](https://camo.githubusercontent.com/5caa455d8debc46fb23abbadb45a733a937f3910a73fc875c2f7820468e1bb54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e)](LICENSE) PHP implementation of [RFC 4226](https://www.rfc-editor.org/rfc/rfc4226.txt) and [RFC 6238](https://www.rfc-editor.org/rfc/rfc6238.txt). Generates one-time passwords. Provides a ready-to-use TOTP class for easy integration with authenticator apps along with an extensible HOTP class for custom one-time password implementations. 1 Installation -------------- [](#1-installation) ``` composer require covaleski/otp ``` 2 Usage ------- [](#2-usage) ### 2.1 TOTP [](#21-totp) The `Totp` class can be used to: - Emit codes; - Validate received codes; - Create URIs for QR code generation. #### 2.1.1 Creating URIs [](#211-creating-uris) Authenticator QR codes are just the OTP URIs encoded as a QR code. Follow the steps below to create the URI. ``` use Covaleski\Otp\Totp; // Define some settings. $digits = 6; $issuer = 'Foobar Inc.'; $label = 'Foobar: john@foobar.com'; // Create a secret. $secret = '1234'; // Instantiate the TOTP class and get the URI. $totp = new Totp($digits, $issuer, $label, $secret); $uri = $totp->getUri(); ``` You can output the URI as a QR code using any library of your choice. #### 2.1.2 Generating and validating codes [](#212-generating-and-validating-codes) Use `getPassword()` to get the current code. ``` use Covaleski\Otp\Totp; // Instantiate the TOPT class. $digits = 6; $totp = new Totp(6, 'Cool LLC', 'Cool: john@cool.com', $secret); // Get the current password. $input = (string) $_POST['code']; $is_valid = $totp->getPassword() === $input; echo 'Your code is ' . ($is_valid ? 'correct!' : 'incorrect!'); ``` #### 2.1.3 Customizing [](#213-customizing) You can change several parameters of your generator. The example below creates a TOTP object that: - Outputs 8-digit codes; - Change the code every 15 seconds; - Calculates the code with a time offset of 1 hour. ``` use Covaleski\Otp\Totp; // Instantiate and configure. $totp = new Totp(8, $issuer, $label, $secret); $totp ->setStep(15) ->setOffset(3600); ``` Note that some implementations may ignore or even reject one or more custom TOTP parameters. The most compatible configuration (usually) is to generate 6-digit codes every 30 seconds with no time offset. ### 2.2 Custom HOTP implementation [](#22-custom-hotp-implementation) You can extend the `Covaleski\Otp\Hotp` to create your own one-time password implementation. Extensions must provide two methods: `getCounter()` and `getUri()`. The first one must output the current counter as an 8-byte binary string (e.g. a time counter), and the second is responsible for providing the integration URI. Furthermore, the `Hotp` class will do the rest and: - Generate the HMAC-SHA-1 string; - Dinamically truncate the HMAC binary string; - Compute the HOTP value and output the required amount of digits. See how the methods are implemented in the `Covaleski\Otp\Totp` class: ``` class Totp extends Hotp { // ...Other class members... /** * Get the current time counter. * * Returns the counter as a 8-byte binary string. */ protected function getCounter(): string { // Get and offset the current UNIX timestamp. $time = time() + $this->offset; // Calculate the number of steps. $counter = floor($time / $this->step); // Format the number as an 8-byte binary string. $counter = dechex($counter); $counter = str_pad($counter, 16, '0', STR_PAD_LEFT); $counter = hex2bin($counter); return $counter; } /** * Get the URI for authentication apps. */ public function getUri(): string { // Encode the secret as base32. $secret = Base32::encode($this->secret); $secret = str_replace('=', '', $secret); // Build URI. return $this->createUri('totp', [ 'secret' => $secret, 'issuer' => $this->issuer, 'algorithm' => 'SHA1', 'digits' => $this->digits, 'period' => $this->step, ]); } // ...Other class members... } ``` The `Totp` class depends on time to create its counter and encode its secrets as base32 strings when creating the URI. 3 Testing --------- [](#3-testing) Tests were made with PHPUnit. Use the following command to run them. ``` ./vendor/bin/phpunit ``` ### Health Score 24 — LowBetter than 32% of packages Maintenance31 Infrequent updates — may be unmaintained Popularity6 Limited adoption so far Community7 Small or concentrated contributor base Maturity43 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~181 days Total 2 Last Release 748d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/35d4c539af573768e021fd53113a4ef76bd133b2988325f35b8ab0a82a2dbf9c?d=identicon)[covaleski](/maintainers/covaleski) --- Top Contributors [![covaleski](https://avatars.githubusercontent.com/u/99929442?v=4)](https://github.com/covaleski "covaleski (23 commits)") ### Code Quality TestsPHPUnit Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/covaleski-otp/health.svg) ``` [![Health](https://phpackages.com/badges/covaleski-otp/health.svg)](https://phpackages.com/packages/covaleski-otp) ``` ### Alternatives [defuse/php-encryption Secure PHP Encryption Library 3.9k162.4M212](/packages/defuse-php-encryption)[roave/security-advisories Prevents installation of composer packages with known security vulnerabilities: no API, simply require it 2.9k97.3M6.4k](/packages/roave-security-advisories)[mews/purifier Laravel 5/6/7/8/9/10 HtmlPurifier Package 2.0k16.7M112](/packages/mews-purifier)[robrichards/xmlseclibs A PHP library for XML Security 41278.1M118](/packages/robrichards-xmlseclibs)[bjeavons/zxcvbn-php Realistic password strength estimation PHP library based on Zxcvbn JS 86917.5M63](/packages/bjeavons-zxcvbn-php)[enlightn/security-checker A PHP dependency vulnerabilities scanner based on the Security Advisories Database. 33732.2M110](/packages/enlightn-security-checker) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)