PHPackages o-ba/mfa-hotp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. o-ba/mfa-hotp ActiveTypo3-cms-extension[Authentication & Authorization](/categories/authentication) o-ba/mfa-hotp ============= TYPO3 hmac-based one-time password provider 1.1.0(3y ago)091GPL-3.0PHPPHP ^7.4 || ^8.0 Since Feb 17Pushed 3y ago1 watchersCompare [ Source](https://github.com/o-ba/mfa_hotp)[ Packagist](https://packagist.org/packages/o-ba/mfa-hotp)[ RSS](/packages/o-ba-mfa-hotp/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (10)Dependencies (6)Versions (14)Used By (0) TYPO3 Extension `mfa_hotp` ========================== [](#typo3-extension-mfa_hotp) This extension adds the HOTP (hmac-based one-time password) MFA provider to TYPO3, using the new MFA API, available since TYPO3 v11.1. It can furthermore be used as an example extension on how to integrate a custom provider into TYPO3. The extension supports all TYPO3 versions >= 11.1 with PHP >= 7.4. **Important**: For better understanding, especially for editors, the provider is referred to as **Counter-based one-time password** in the TYPO3 backend. **Note**: Since the TYPO3 MFA API is still experimental, changes in upcoming releases are to be expected. Installation ------------ [](#installation) You can install the extension via composer `composer req o-ba/mfa-hotp`, download the release packages ([zip](https://github.com/o-ba/hotp/archive/1.1.0.zip), [tar.gz](https://github.com/o-ba/hotp/archive/1.1.0.tar.gz)) or via the [TYPO3 extension repository](https://extensions.typo3.org/extension/mfa_hotp/). About HOTP ---------- [](#about-hotp) The HOTP MFA Provider is based on a shared secret, which will be exchanged between an OTP application (or device) and TYPO3. Each code takes the initially defined shared secret and an increasing counter value into account. Each code is only valid once, since the counter value will be updated on both sides after every authentication attempt. Therefore, this provider is also called **Counter-based one-time password**. To use this provider: 1. Navigate to the MFA module in the TYPO3 backend and click on "Setup" 2. Scan the QR-code or directly enter the shared secret in an OTP application or device 3. Enter the generated six-digit code in the corresponding field 4. Submit the form to activate the MFA provider 5. Alternatively also activate the built-in `Recovery codes` provider In the providers' editing view, it's also possible to initiate the counter resynchronization. This will be necessary, in case the local counter value (client side) does no longer match the expected counter value on the server side. TYPO3 and multi-factor authentication ------------------------------------- [](#typo3-and-multi-factor-authentication) You can read more about the implementation in the official [changelog](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/11.1/Feature-93526-MultiFactorAuthentication.html). Further TYPO3 extensions adding MFA providers --------------------------------------------- [](#further-typo3-extensions-adding-mfa-providers) - [mfa\_yubikey](https://github.com/derhansen/mfa_yubikey) - [mfa\_webauthn](https://github.com/bnf/mfa_webauthn) Credits ------- [](#credits) Icons used in this repository are made by [Freepik](https://www.flaticon.com/authors/freepik) from [www.flaticon.com](https://www.flaticon.com/). ### Health Score 28 — LowBetter than 54% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity10 Limited adoption so far Community7 Small or concentrated contributor base Maturity64 Established project with proven stability Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~52 days Recently: every ~120 days Total 13 Last Release 1279d ago Major Versions 0.1.7 → 1.0.02021-10-04 PHP version history (2 changes)0.0.1PHP >=7.4 0.1.6PHP ^7.4 || ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/d1bfc89c42d831e190c1023b69a614bbbc3fc261def8b5e462467d142eaa4d1a?d=identicon)[o-ba](/maintainers/o-ba) --- Top Contributors [![o-ba](https://avatars.githubusercontent.com/u/8812114?v=4)](https://github.com/o-ba "o-ba (43 commits)") --- Tags hotpmulti-factor-authenticationtypo3typo3-cms-extension ### Embed Badge ![Health badge](/badges/o-ba-mfa-hotp/health.svg) ``` [![Health](https://phpackages.com/badges/o-ba-mfa-hotp/health.svg)](https://phpackages.com/packages/o-ba-mfa-hotp) ``` ### Alternatives [jeffgreco13/filament-breezy A custom package for Filament with login flow, profile and teams support. 1.0k1.7M41](/packages/jeffgreco13-filament-breezy)[laragear/two-factor On-premises 2FA Authentication for out-of-the-box. 339785.3k8](/packages/laragear-two-factor)[in2code/femanager Modern TYPO3 Frontend User Registration. 49745.4k6](/packages/in2code-femanager)[stephenjude/filament-two-factor-authentication Filament Two Factor Authentication: Google 2FA + Passkey Authentication 81158.7k4](/packages/stephenjude-filament-two-factor-authentication)[rainlab/user-plugin User plugin for October CMS 11954.3k13](/packages/rainlab-user-plugin)[friendsoftypo3/openid OpenID authentication for TYPO3 CMS 1396.0k](/packages/friendsoftypo3-openid) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)