PHPackages                             kelunik/two-factor - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. kelunik/two-factor

ActiveLibrary[Authentication & Authorization](/categories/authentication)

kelunik/two-factor
==================

Two factor authentication.

v1.1.3(5y ago)371.9k42MITPHPPHP >=7.1CI failing

Since Apr 18Pushed 5y ago2 watchersCompare

[ Source](https://github.com/kelunik/two-factor)[ Packagist](https://packagist.org/packages/kelunik/two-factor)[ RSS](/packages/kelunik-two-factor/feed)WikiDiscussions master Synced 3w ago

READMEChangelog (5)Dependencies (3)Versions (6)Used By (2)

two-factor
==========

[](#two-factor)

[![Build Status](https://camo.githubusercontent.com/9c10dcf7946843039be3f1b279870b0748a8e4d39059a55aaca889291a34c479/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f6b656c756e696b2f74776f2d666163746f722f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://travis-ci.org/kelunik/two-factor)[![CoverageStatus](https://camo.githubusercontent.com/5479fd13001883541fececa713aa10b28528d66c912b3ee51f6f6fa7aa49954c/68747470733a2f2f696d672e736869656c64732e696f2f636f766572616c6c732f6b656c756e696b2f74776f2d666163746f722f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://coveralls.io/github/kelunik/two-factor?branch=master)[![License](https://camo.githubusercontent.com/942e017bf0672002dd32a857c95d66f28c5900ab541838c6c664442516309c8a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e7376673f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/942e017bf0672002dd32a857c95d66f28c5900ab541838c6c664442516309c8a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e7376673f7374796c653d666c61742d737175617265)

`kelunik/two-factor` is a Google Authenticator compatible OATH implementation.

Requirements
------------

[](#requirements)

- PHP 5.5+

Installation
------------

[](#installation)

```
composer require kelunik/two-factor
```

Demo
----

[](#demo)

There's a [runnable demo](./examples/demo.php) contained in this repository.

Usage
-----

[](#usage)

### Generate a secret per user

[](#generate-a-secret-per-user)

```
$oath = new Oath;

// this generates a key in binary format
$key = $oath->generateKey();

// store key for user
```

### Let user setup two factor device

[](#let-user-setup-two-factor-device)

```
$oath = new Oath;
$key = "..."; // load user key from storage

// Use the URI to provide an easy to scan QR code
$uri = $oath->getUri($key);

// Alternatively display the key for manual input
$secret = $oath->encodeKey($key);
```

You can use your favourite JavaScript or PHP library to generate the QR code. For a working example, we're using [`qr.js`](http://neocotic.com/qr.js/).

```

    Scan the following QR code and click continue once you're ready.

        qr.canvas({
            canvas: document.getElementById("qr-code"),
            value: document.getElementById("2fa-uri").value
        });

    Continue

```

### Validate TOTP value

[](#validate-totp-value)

```
$oath = new Oath;
$key = "..."; // load user key from storage
$isValid = $oath->verifyTotp($key, $totpValue);
// If the token is valid, ensure that it can't be used again.
// Because we use the default grace window size of two,
// we have to store the used TOTP value for at least 90 seconds,
// to prevent its usage explicitly.
```

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity29

Limited adoption so far

Community17

Small or concentrated contributor base

Maturity62

Established project with proven stability

 Bus Factor1

Top contributor holds 92.3% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~472 days

Total

5

Last Release

1828d ago

PHP version history (3 changes)v1.0.0PHP ^5.5|^7

v1.1.2PHP >=5.5

v1.1.3PHP >=7.1

### Community

Maintainers

![](https://www.gravatar.com/avatar/12852217f3369e8144bc9ce6ac2a2341c28c5512c5b3df5749bfbbd45b6877ff?d=identicon)[kelunik](/maintainers/kelunik)

---

Top Contributors

[![kelunik](https://avatars.githubusercontent.com/u/2743004?v=4)](https://github.com/kelunik "kelunik (24 commits)")[![paragonie-scott](https://avatars.githubusercontent.com/u/11591518?v=4)](https://github.com/paragonie-scott "paragonie-scott (1 commits)")[![paragonie-security](https://avatars.githubusercontent.com/u/15914520?v=4)](https://github.com/paragonie-security "paragonie-security (1 commits)")

---

Tags

2fagoogle-authenticatoroath-hotpoath-totptwo-factorhotptotpAuthentication2fatwo-factoroath

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/kelunik-two-factor/health.svg)

```
[![Health](https://phpackages.com/badges/kelunik-two-factor/health.svg)](https://phpackages.com/packages/kelunik-two-factor)
```

###  Alternatives

[laragear/two-factor

On-premises 2FA Authentication for out-of-the-box.

339889.0k15](/packages/laragear-two-factor)[paragonie/multi-factor

Vendor-agnostic two-factor authentication library

142197.5k2](/packages/paragonie-multi-factor)[chillerlan/php-authenticator

A generator for counter- and time based 2-factor authentication codes (Google Authenticator). PHP 8.2+

56127.6k3](/packages/chillerlan-php-authenticator)[lfkeitel/phptotp

TOTP/HOTP library for PHP

85462.0k2](/packages/lfkeitel-phptotp)[scheb/2fa-totp

Extends scheb/2fa-bundle with two-factor authentication using TOTP

283.1M45](/packages/scheb-2fa-totp)[jiripudil/otp

Library that generates and verifies one-time passwords.

2827.4k1](/packages/jiripudil-otp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)