PHPackages laravel-liberu/laravel-two-factor - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. laravel-liberu/laravel-two-factor ActiveLibrary[Authentication & Authorization](/categories/authentication) laravel-liberu/laravel-two-factor ================================= Two-factor authentication implementation for Laravel applications. v0.0.9(2y ago)23[4 PRs](https://github.com/laravel-liberu/laravel-two-factor/pulls)MITPHPPHP ^8.0 Since Mar 1Pushed 1y ago2 watchersCompare [ Source](https://github.com/laravel-liberu/laravel-two-factor)[ Packagist](https://packagist.org/packages/laravel-liberu/laravel-two-factor)[ Docs](https://github.com/emargareten/two-factor-laravel)[ RSS](/packages/laravel-liberu-laravel-two-factor/feed)WikiDiscussions master Synced 1mo ago READMEChangelogDependencies (7)Versions (14)Used By (0) Two-Factor-Laravel ================== [](#two-factor-laravel) [![Latest Version on Packagist](https://camo.githubusercontent.com/0ebfc14ec392fb767b75f529b9f22d0a98ca0de7dbc64bf75bf48db675b7c822/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f656d61726761726574656e2f74776f2d666163746f722d6c61726176656c2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/emargareten/two-factor-laravel)[![GitHub Tests Action Status](https://camo.githubusercontent.com/de92ac2b1042357e43622d34971e63f1ca744de4efec98874ecc3a65185ecb46/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f656d61726761726574656e2f74776f2d666163746f722d6c61726176656c2f72756e2d74657374732e796d6c3f6272616e63683d6d6173746572266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/emargareten/two-factor-laravel/actions?query=workflow%3Arun-tests+branch%3Amaster)[![GitHub Code Style Action Status](https://camo.githubusercontent.com/f097913e17094ef4b8810807a0b012113d8c7422aa95672dba26747c8ec85b13/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f656d61726761726574656e2f74776f2d666163746f722d6c61726176656c2f6669782d7068702d636f64652d7374796c652d6973737565732e796d6c3f6272616e63683d6d6173746572266c6162656c3d636f64652532307374796c65267374796c653d666c61742d737175617265)](https://github.com/emargareten/two-factor-laravel/actions?query=workflow%3A%22Fix+PHP+code+style+issues%22+branch%3Amaster)[![Total Downloads](https://camo.githubusercontent.com/934f1f0448ac02183f6f2a574da3087027f72dd022bcbc4ee208bf93938cb690/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f656d61726761726574656e2f74776f2d666163746f722d6c61726176656c2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/emargareten/two-factor-laravel) Two-Factor-Laravel is a package that implements two-factor authentication for your Laravel apps. If enabled, the user will be required to enter a six digit numeric token during the authentication process. This token is generated using a time-based one-time password (TOTP) that can be retrieved from any TOTP compatible mobile authentication application such as Google Authenticator. You can also retrieve the current one-time password and send it to the user via SMS/email. Installation ------------ [](#installation) First, install the package into your project using composer: ``` composer require emargareten/two-factor-laravel ``` Next, you should publish the configuration and migration files using the `vendor:publish` Artisan command: ``` php artisan vendor:publish --provider="Emargareten\TwoFactor\ServiceProvider" ``` Finally, you should run your application's database migrations. This will add the two-factor columns to the `users` table: ``` php artisan migrate ``` ### Configuration [](#configuration) After publishing the assets, you may review the `config/two-factor.php` configuration file. This file contains several options that allow you to customize the behavior of the two-factor authentication features. Usage ----- [](#usage) To start using two-factor authentication, you should first add the `TwoFactorAuthenticatable` trait to your `User` model: ``` use Emargareten\TwoFactor\TwoFactorAuthenticatable; class User extends Authenticatable { use TwoFactorAuthenticatable; } ``` ### Enabling Two-Factor Authentication [](#enabling-two-factor-authentication) This package provides the logic for authenticating users using two-factor authentication. However, it is up to you to provide the user interface and controllers for enabling and disabling two-factor authentication. To enable two-factor authentication for a user, you should call the `enableTwoFactorAuthentication` method on the user model. This will generate a secret key and recovery codes for the user and store them in the database (encrypted): ``` use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; class TwoFactorAuthenticationController extends Controller { /** * Enable two-factor authentication for the user. */ public function store(Request $request): RedirectResponse { $user = $request->user(); if ($user->hasEnabledTwoFactorAuthentication()) { return back()->with('status', 'Two-factor authentication is already enabled'); } $user->enableTwoFactorAuthentication(); return redirect()->route('account.two-factor-authentication.confirm.show'); } } ``` ### Confirming Two-Factor Authentication [](#confirming-two-factor-authentication) After enabling two-factor authentication, the user must still "confirm" their two-factor authentication configuration by providing a valid two-factor authentication code. You should provide a way for the user to do this. For example, you could provide a view that displays the QR code and secret key for the user to scan into their authenticator app: ``` use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; use Illuminate\View\View; class TwoFactorAuthenticationConfirmationController extends Controller { /** * Get the two-factor authentication confirmation view. */ public function show(Request $request): View|RedirectResponse { $user = $request->user(); if ($user->hasEnabledTwoFactorAuthentication()) { return back()->with('status', 'Two-factor authentication is already enabled'); } if (! $user->two_factor_secret) { return back()->with('status', 'Two-factor authentication is not enabled'); } return view('account.two-factor-confirmation.show', [ 'qrCodeSvg' => $user->twoFactorQrCodeSvg(), 'setupKey' => $user->two_factor_secret, ]); } /** * Confirm two-factor authentication for the user. */ public function store(Request $request): RedirectResponse { $request->validate([ 'code' => ['required', 'string'], ]); $request->user()->confirmTwoFactorAuthentication($request->code); return redirect() ->route('account.two-factor-authentication.recovery-codes.index') ->with('status', 'Two-factor authentication successfully confirmed'); } } ``` If you prefer to use a different method for receiving the one-time password, i.e. SMS/email, you can use the `getCurrentOtp` method on the user model to retrieve the current one-time password: ``` $user->getCurrentOtp(); ``` > **Note**When sending the one-time-password via SMS/email, you should set the window to a higher value, to allow the user to enter the one-time password after it has been sent. The `confirmTwoFactorAuthentication` method takes an optional second parameter to specify the two-factor method, this is totally optional, it can be useful if you have multiple methods for receiving the one-time password. ### Disabling Two-Factor Authentication [](#disabling-two-factor-authentication) You should also provide a way for the user to disable two-factor authentication. This can be done by calling the `disableTwoFactorAuthentication` method on the user model: ``` /** * Disable two-factor authentication for the user. */ public function destroy(Request $request): RedirectResponse { $request->user()->disableTwoFactorAuthentication(); return back()->with('status', 'Two-factor authentication disabled successfully'); } ``` ### User Authenticaion [](#user-authenticaion) Once the user has confirmed enabling two-factor authentication, each time they log in, they will be redirected to a page where they will be asked to enter a one-time password generated by their authenticator app. ``` use Emargareten\TwoFactor\Actions\TwoFactorRedirector; use Illuminate\Http\Request; use Symfony\Component\HttpFoundation\Response; public function login(Request $request, TwoFactorRedirector $redirector): Response { // do login stuff... return $redirector->redirect($request); } ``` This will redirect the user to the `two-factor-challenge.create` route. The `TwoFactorAuthenticationChallenged` event will be fired if the user is being redirected to the two-factor challenge page, you can listen to this event to add additional logic, for example, you could send the one-time password via SMS/email: ``` public function handle(TwoFactorAuthenticationChallenged $event): void { $event->user->notify(new CompleteSignInOTP); } ``` You will need to provide a view for the `two-factor-challenge.create` route. This view should contain a form where the user can enter the one-time password, you should bind the view in the `register` method of your `AppServiceProvider` by calling the `TwoFactor::challengeView()` method: ``` /** * Register any application services. */ public function register(): void { TwoFactor::challengeView('two-factor-challenge.create'); } ``` Or use a closure to generate a custom response: ``` TwoFactor::challengeView(function (Request $request) { return Inertia::render('TwoFactorChallenge/Create'); }); ``` The form should be submitted to the `two-factor-challenge.store` route. Once the user has entered a valid one-time password, he will be redirected to the intended URL (or to the home route defined in the config file if no intended URL was set). ### Recovery Codes [](#recovery-codes) This package also provides the logic for generating and using recovery codes. Recovery codes can be used to access the application in case the user loses access to their authenticator app. After enabling two-factor authentication, you should redirect the user to a page where they can view their recovery codes. You can also generate a fresh set of recovery codes by calling the `generateNewRecoveryCodes` method on the user model: ``` use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; use Illuminate\View\View; class TwoFactorAuthenticationRecoveryCodeController extends Controller { /** * Get the two-factor authentication recovery codes for authenticated user. */ public function index(Request $request): View|RedirectResponse { if (! $request->user()->hasEnabledTwoFactorAuthentication()) { return back()->with('status', 'Two-factor authentication is disabled'); } return view('two-factor-recovery-codes.index', [ 'recoveryCodes' => $request->user()->two_factor_recovery_codes, ]); } /** * Generate a fresh set of two-factor authentication recovery codes. */ public function store(Request $request): RedirectResponse { if (! $request->user()->hasEnabledTwoFactorAuthentication()) { return back()->with('status', 'Two-factor authentication is disabled'); } $request->user()->generateNewRecoveryCodes(); return redirect()->route('account.two-factor-authentication.recovery-codes.index'); } } ``` To use the recovery codes, you should add a view for the `two-factor-challenge-recovery.create` route. This view should contain a form where the user can enter a recovery code. You should bind the view in the `register` method of your `AppServiceProvider` by calling the `TwoFactor::challengeRecoveryView()` method: The form should be submitted to the `two-factor-challenge-recovery.store` route. Testing ------- [](#testing) ``` composer test ``` Changelog --------- [](#changelog) Please see [CHANGELOG](CHANGELOG.md) for more information on what has changed recently. Credits ------- [](#credits) - [emargareten](https://github.com/emargareten) - [All Contributors](../../contributors) License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE.md) for more information. ### Health Score 24 — LowBetter than 32% of packages Maintenance27 Infrequent updates — may be unmaintained Popularity6 Limited adoption so far Community12 Small or concentrated contributor base Maturity47 Maturing project, gaining track record Bus Factor1 Top contributor holds 59.5% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~27 days Recently: every ~54 days Total 9 Last Release 949d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/179251?v=4)[Curtis Delicata](/maintainers/curtisdelicata)[@curtisdelicata](https://github.com/curtisdelicata) --- Top Contributors [![emargareten](https://avatars.githubusercontent.com/u/46111162?v=4)](https://github.com/emargareten "emargareten (22 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (7 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (7 commits)")[![curtisdelicata](https://avatars.githubusercontent.com/u/179251?v=4)](https://github.com/curtisdelicata "curtisdelicata (1 commits)") --- Tags laravel2faTwo Factor Authentication ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StyleLaravel Pint Type Coverage Yes ### Embed Badge ![Health badge](/badges/laravel-liberu-laravel-two-factor/health.svg) ``` [![Health](https://phpackages.com/badges/laravel-liberu-laravel-two-factor/health.svg)](https://phpackages.com/packages/laravel-liberu-laravel-two-factor) ``` ### Alternatives [stephenjude/filament-two-factor-authentication Filament Two Factor Authentication: Google 2FA + Passkey Authentication 81158.7k4](/packages/stephenjude-filament-two-factor-authentication)[laragear/two-factor On-premises 2FA Authentication for out-of-the-box. 339785.3k8](/packages/laragear-two-factor)[ellaisys/aws-cognito AWS Cognito package that allows Auth and other related features using the AWS SDK for PHP 120220.7k1](/packages/ellaisys-aws-cognito)[webbingbrasil/filament-2fa A 2FA plugin for filament. 4740.7k](/packages/webbingbrasil-filament-2fa)[emargareten/two-factor-laravel Two-factor authentication implementation for Laravel applications. 4028.9k](/packages/emargareten-two-factor-laravel) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)