PHPackages                             ndtan/php-2fa - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. ndtan/php-2fa

ActiveLibrary[Authentication & Authorization](/categories/authentication)

ndtan/php-2fa
=============

NDT 2FA — TOTP (RFC 6238) for PHP with backup codes, otpauth URIs, and QR generation (SVG). Laravel & Symfony integrations included.

v0.1.0(8mo ago)01MITPHPPHP >=8.1CI passing

Since Sep 21Pushed 8mo agoCompare

[ Source](https://github.com/nguyenduytan/NDT-2FA)[ Packagist](https://packagist.org/packages/ndtan/php-2fa)[ RSS](/packages/ndtan-php-2fa/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (1)Dependencies (2)Versions (2)Used By (0)

NDT 2FA (PHP)
=============

[](#ndt-2fa-php)

> TOTP (RFC 6238) for PHP with **backup codes**, **otpauth URIs**, and **QR generation** (SVG).
> Ready for **plain PHP**, **Laravel**, and **Symfony**.

 [![PHP](https://camo.githubusercontent.com/3e41095f4ad1c6ad78f988bd1c107f87972f334143c3ba814165a03e1f43a63c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e312532422d3737374242343f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/3e41095f4ad1c6ad78f988bd1c107f87972f334143c3ba814165a03e1f43a63c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e312532422d3737374242343f6c6f676f3d706870266c6f676f436f6c6f723d7768697465) [![License](https://camo.githubusercontent.com/5caa455d8debc46fb23abbadb45a733a937f3910a73fc875c2f7820468e1bb54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e)](https://camo.githubusercontent.com/5caa455d8debc46fb23abbadb45a733a937f3910a73fc875c2f7820468e1bb54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e) [![Status](https://camo.githubusercontent.com/7d651106bbef470d9f836feb1346fc1c9843f67929bc912789ebac0047fa011e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f3246412d544f54502532302537432532304261636b7570253230436f64657325323025374325323051522d626c7565)](https://camo.githubusercontent.com/7d651106bbef470d9f836feb1346fc1c9843f67929bc912789ebac0047fa011e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f3246412d544f54502532302537432532304261636b7570253230436f64657325323025374325323051522d626c7565)

---

Table of Contents
-----------------

[](#table-of-contents)

- [Features](#features)
- [Installation](#installation)
- [Quick Start (Plain PHP)](#quick-start-plain-php)
- [Backup Codes](#backup-codes)
- [QR Codes](#qr-codes)
- [Framework Integrations](#framework-integrations)
    - [Laravel](#laravel)
    - [Symfony](#symfony)
- [Secure Verification (Rate Limit + Replay Protection)](#secure-verification-rate-limit--replay-protection)
- [API Reference](#api-reference)
- [Security Notes](#security-notes)
- [Testing](#testing)
- [License](#license)

---

Features
--------

[](#features)

- ✅ **TOTP (RFC 6238)** — SHA1 / SHA256 / SHA512; configurable `digits` / `period` / `window`
- ✅ **Base32 secrets** — generate & decode for authenticator apps
- ✅ **otpauth URIs** — compatible with Google Authenticator, Authy, etc.
- ✅ **Backup codes** — plaintext generation + secure `password_hash`/`password_verify`
- ✅ **QR generator (SVG Data URI)** — via `endroid/qr-code`
- ✅ **Security add-ons** — Attempt limiter, replay protection, unified `Verifier`
- ✅ **Frameworks** — Laravel ServiceProvider (auto-discovery) & Symfony console command
- ✅ **Zero-heavy deps** — Only `endroid/qr-code` for QR (core TOTP is dependency-free)

---

Installation
------------

[](#installation)

```
composer require ndtan/php-2fa
```

> PHP **8.1+** is required.

---

Quick Start (Plain PHP)
-----------------------

[](#quick-start-plain-php)

```