PHPackages makelarisjr/laravel-2fa - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. makelarisjr/laravel-2fa ActiveLibrary[Authentication & Authorization](/categories/authentication) makelarisjr/laravel-2fa ======================= 1.6(2y ago)58.2k2MITPHPPHP ^7.4|^8.0 Since Sep 6Pushed 2y ago1 watchersCompare [ Source](https://github.com/makelarisjr/laravel-2fa)[ Packagist](https://packagist.org/packages/makelarisjr/laravel-2fa)[ RSS](/packages/makelarisjr-laravel-2fa/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (8)Dependencies (7)Versions (9)Used By (0) Laravel 2FA Package =================== [](#laravel-2fa-package) This package provides all the necessary tools for a complete implementation of Google's OTP and Yubikey 2FA. [![Latest Stable Version](https://camo.githubusercontent.com/1776b7db150c00a59478295434f5b3de597a6ffa46d3a8bd1362ca548756828e/687474703a2f2f706f7365722e707567782e6f72672f6d616b656c617269736a722f6c61726176656c2d3266612f76)](https://packagist.org/packages/makelarisjr/laravel-2fa) [![Total Downloads](https://camo.githubusercontent.com/226c32a64194ee582f01db6cadd497bfb78efd6aa77bf4fdee02dc7e747adba7/687474703a2f2f706f7365722e707567782e6f72672f6d616b656c617269736a722f6c61726176656c2d3266612f646f776e6c6f616473)](https://packagist.org/packages/makelarisjr/laravel-2fa) [![Latest Unstable Version](https://camo.githubusercontent.com/0bbae47d2a6731b04ee5cea82150746f7c1059a13ade1831a191ddb4a2cb527f/687474703a2f2f706f7365722e707567782e6f72672f6d616b656c617269736a722f6c61726176656c2d3266612f762f756e737461626c65)](https://packagist.org/packages/makelarisjr/laravel-2fa) [![License](https://camo.githubusercontent.com/69278753affd9ade799dc915c860b1ec0cf84a8d16785282254133c0b286c2e6/687474703a2f2f706f7365722e707567782e6f72672f6d616b656c617269736a722f6c61726176656c2d3266612f6c6963656e7365)](https://packagist.org/packages/makelarisjr/laravel-2fa) [![PHP Version Require](https://camo.githubusercontent.com/c8e70e82193e096851b3e41468009a132883e176fa989b532f28bb1033c6f481/687474703a2f2f706f7365722e707567782e6f72672f6d616b656c617269736a722f6c61726176656c2d3266612f726571756972652f706870)](https://packagist.org/packages/makelarisjr/laravel-2fa) Requirements ------------ [](#requirements) - **PHP:** >=7.4 - **Laravel:** >=7.0 Installation ------------ [](#installation) Type the following command in your terminal/command line: `composer require makelarisjr/laravel-2fa` The service provider will automatically get registered. You may also manually add the service provider in your config/app.php file: ``` 'providers' => [ // ... MakelarisJR\Laravel2FA\Laravel2FAServiceProvider::class, ]; ``` Publish the configuration file by typing the following command: ``` php artisan vendor:publish --provider="MakelarisJR\Laravel2FA\Laravel2FAServiceProvider" ``` For more info about the configuration, please refer to the [Wiki article](https://github.com/makelarisjr/laravel-2fa/wiki/Configuration) Next, you have to add the necessary trait to the authenticatable model. This package can be used by any model, and you are not limited only to the User model. ``` use MakelarisJR\Laravel2FA\Traits\Has2FA; ``` Now that you have set up the model, create a Route group with all the routes that will require the user to have a valid OTP authorization. Example: ``` Route::group(['middleware' => ['auth', 'otp']], function(){ Route::view('/dashboard', 'dashboard') ->name('dashboard'); Route::view('/devices', 'devices') ->name('device.list'); }); ``` You can add the `otp` middleware alias to any group you like. Furthermore, the middleware will automatically prompt the user to enter the OTP code if the session needs to be refreshed. You don't need to implement your own verification logic if you use the middleware. Last but not least, run the migrations. ``` php artisan migrate ``` This will create the following tables: - otp\_devices - otp\_backup\_codes - otp\_remember\_tokens Usage ----- [](#usage) ### Adding Devices [](#adding-devices) Now it's time to add a new device to our model. The trait that we added provides a `addDevice` method which accepts the following parameters: ``` function addDevice(string $name, string $otp_secret, string $type = OtpDevice::TYPE_GOOGLE): OtpDevice ``` For type, you may choose one of the following: - OtpDevice::TYPE\_GOOGLE - OtpDevice::TYPE\_YUBIKEY In case of Yubikey, you may provide the full key which is 44 characters, or the device id which is the first 12 characters. The package will "cut" the string accordingly. For Google OTP you will need to generate a QR code before or enter the secret manually to your device. Here is a simple example: ``` $user = User::find(1); // ['secret' => string, 'qrcode' => string] $data = $user->generateGoogleQRCode('My Application', $user->email); $user->addDevice('My iPhone', $data['secret']); ``` The QRCode is in the form of a base64 string which can be returned to the user and be scanned by the phone. ### Verify OTP [](#verify-otp) As mentioned before, the `otp` middleware will handle the verification without having to do something yourself. It is possible however to create your very own implementation, especially if you are planning to use another frontend framework like `Vue`, `React`, etc... To verify the code inserted by the user, use the following method provided by the trait: ``` $user->verifyOtp(string $otp): bool ``` The `string $otp` can either be the code provided by the Google authenticator, or the 44 digits code provided by the Yubikey, or one of the backup codes. The method will return `true` if the verification is successful or `false` if it's not. ### Backup Codes [](#backup-codes) It is also possible to generate backup codes that can be used in case you lose your device. This is a recommended safety practise because in the authentication device is lost or destroyed you won't be able to sign in to your account. To generate the codes, you may use the following method: ``` $user->generateBackupCodes(int $total = 8, bool $force = false): array ``` The first numeric parameter designates the total number of codes that will be generated. The default is 8. The second parameter, force, designates whether new codes will be generated. Once the backup codes are created, it is not possible to create them again, unless you set `force` to true which in that case, the old ones will be deleted and a new batch will be created. ### Extended Documentation [](#extended-documentation) For the extended documentation please refer to the [Wiki](https://github.com/makelarisjr/laravel-2fa/wiki) Security Vulnerabilities ------------------------ [](#security-vulnerabilities) If you discover a security vulnerability within Laravel2FA, please send an e-mail to makelarisjr via . All security vulnerabilities will be promptly addressed. License ------- [](#license) The Laravel2FA is open-sourced software licensed under the [MIT license](https://opensource.org/licenses/MIT). ### Health Score 32 — LowBetter than 72% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity24 Limited adoption so far Community13 Small or concentrated contributor base Maturity61 Established project with proven stability Bus Factor1 Top contributor holds 57.5% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~126 days Recently: every ~220 days Total 8 Last Release 826d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/f9439a43752f2f6cb8693376d63a3b34ad87c2366584cd5a8e79d0450a2d32d1?d=identicon)[meletisf](/maintainers/meletisf) ![](https://www.gravatar.com/avatar/6e9fc780169c769caa7ae4000bd5e37e1406e61da35367328414ccc08e457afd?d=identicon)[makelarisjr](/maintainers/makelarisjr) --- Top Contributors [![meletisf](https://avatars.githubusercontent.com/u/3215590?v=4)](https://github.com/meletisf "meletisf (23 commits)")[![makelarisjr](https://avatars.githubusercontent.com/u/8687447?v=4)](https://github.com/makelarisjr "makelarisjr (16 commits)")[![gkoniaris](https://avatars.githubusercontent.com/u/13465089?v=4)](https://github.com/gkoniaris "gkoniaris (1 commits)") --- Tags laravelotptotpAuthentication2fagoogle2fayubikey ### Code Quality Code StylePHP CS Fixer ### Embed Badge ![Health badge](/badges/makelarisjr-laravel-2fa/health.svg) ``` [![Health](https://phpackages.com/badges/makelarisjr-laravel-2fa/health.svg)](https://phpackages.com/packages/makelarisjr-laravel-2fa) ``` ### Alternatives [stephenjude/filament-two-factor-authentication Filament Two Factor Authentication: Google 2FA + Passkey Authentication 81158.7k4](/packages/stephenjude-filament-two-factor-authentication)[remotemerge/totp-php Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration. 2010.2k](/packages/remotemerge-totp-php) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)