PHPackages padosoft/laravel-rebel-recovery - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. padosoft/laravel-rebel-recovery ActiveLibrary[Authentication & Authorization](/categories/authentication) padosoft/laravel-rebel-recovery =============================== High-assurance account recovery for Laravel Rebel: single-use HMAC-hashed recovery (backup) codes, generated once at enrolment, with anti-ATO checks. Part of padosoft/laravel-rebel-\*. v0.1.0(1mo ago)085↓90%1MITPHPPHP ^8.3CI passing Since Jun 3Pushed 1mo agoCompare [ Source](https://github.com/padosoft/laravel-rebel-recovery)[ Packagist](https://packagist.org/packages/padosoft/laravel-rebel-recovery)[ Docs](https://github.com/padosoft/laravel-rebel-recovery)[ RSS](/packages/padosoft-laravel-rebel-recovery/feed)WikiDiscussions main Synced 1w ago READMEChangelog (1)Dependencies (9)Versions (4)Used By (1) Laravel Rebel — Recovery ======================== [](#laravel-rebel--recovery) > Official documentation: > **Single-use recovery codes done right.** Backup codes the user can fall back to when they lose their device — generated once, stored only as keyed HMACs, verified in constant time, single-use, and easy to type. Part of the `padosoft/laravel-rebel-*` suite. [![Laravel Rebel](resources/screenshoots/Laravel-Rebel-banner.png)](resources/screenshoots/Laravel-Rebel-banner.png) [![Laravel 12|13](https://camo.githubusercontent.com/9e9b743bcbf97a29fe735334a4a8e906d05d60310969905af6607cef8da30138/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d313225323025374325323031332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/9e9b743bcbf97a29fe735334a4a8e906d05d60310969905af6607cef8da30138/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d313225323025374325323031332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465) [![PHP 8.3+](https://camo.githubusercontent.com/6aa777dd33ef43fbef727d8187b578003a61e5dc41bbc958b0938c996cdc92f2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e33253230253743253230382e34253230253743253230382e352d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/6aa777dd33ef43fbef727d8187b578003a61e5dc41bbc958b0938c996cdc92f2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e33253230253743253230382e34253230253743253230382e352d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465) [![PHPStan max](https://camo.githubusercontent.com/4b9a3c97d76534abb905e64bd9e5bb9f13fe68e962071e0ccbbe7b629112f11c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6d61782d3241364644423f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/4b9a3c97d76534abb905e64bd9e5bb9f13fe68e962071e0ccbbe7b629112f11c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6d61782d3241364644423f7374796c653d666c61742d737175617265) [![Pest 4](https://camo.githubusercontent.com/9b9da1d7d243a7465ab338e9374e47300a7fe2e26b5c291e7e3c95b53153789a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f74657374732d50657374253230342d3232433535453f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/9b9da1d7d243a7465ab338e9374e47300a7fe2e26b5c291e7e3c95b53153789a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f74657374732d50657374253230342d3232433535453f7374796c653d666c61742d737175617265) [![MIT](https://camo.githubusercontent.com/ac049ef4e7a0b7196b09add6ac2d4f180e544c0ac779c2b2ac2fd2723a209579/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75653f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/ac049ef4e7a0b7196b09add6ac2d4f180e544c0ac779c2b2ac2fd2723a209579/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75653f7374796c653d666c61742d737175617265) --- Table of contents ----------------- [](#table-of-contents) - [What it is](#what-it-is) - [Why this package](#why-this-package) - [Rebel Recovery vs the alternatives](#rebel-recovery-vs-the-alternatives) - [Installation](#installation) - [Usage](#usage) - [Security notes](#security-notes) - [`.env.example`](#envexample) - [Testing & License](#testing--license) --- What it is ---------- [](#what-it-is) High-assurance account-recovery building blocks for Rebel. v0.1.0 ships **recovery (backup) codes**: a set of one-time codes a user can use to recover access. Pair them with a high-assurance step-up purpose (from `laravel-rebel-step-up`) to gate sensitive recovery flows. Depends on [`padosoft/laravel-rebel-core`](https://github.com/padosoft/laravel-rebel-core). --- Why this package ---------------- [](#why-this-package) ★WhatIn short★★★**Hashed at rest**Codes are stored as a keyed HMAC of `(salt|code)` with a `key_version` — never plaintext, pepper-rotation friendly.★★★**Single-use & atomic**Verification locks the row and consumes the code; a code works exactly once.★★★**Constant-time verify**All candidates are checked without early-exit, so timing doesn't leak which code matched.★★**Typo-tolerant**Input is normalized (case, separators, Crockford O→0 / I·L→1), so a correct code never fails on format.★★**Regenerate safely**Generating a new set invalidates all previous unconsumed codes.★★**Audited & multi-tenant**Generate/complete/fail are recorded; rows are tenant-scoped.--- Rebel Recovery vs the alternatives ---------------------------------- [](#rebel-recovery-vs-the-alternatives) Capability**Rebel Recovery**ShopifyFortify recovery codesHand-rolledSelf-issued recovery codes for your users✅❌✅➖Codes hashed at rest (you control storage)✅❌➖ (encrypted blob)❌Keyed HMAC + key\_version (pepper rotation)✅❌❌❌Constant-time verification✅➖➖❌Atomic single-use (row lock)✅➖➖❌Input normalization (typo-tolerant)✅➖❌❌~100-bit entropy codes✅➖➖ (~50 bits)➖Audited + multi-tenant (your app)✅❌❌❌> Legend: ✅ built-in · ➖ partial / hosted-only / not exposed to you · ❌ not available. > > Note: Shopify is a hosted, closed commerce platform — its own staff/customer logins may have backup codes, but it never exposes a self-hostable, HMAC-hashed, single-use recovery-code API you can issue to your application's users. --- Installation ------------ [](#installation) ``` composer require padosoft/laravel-rebel-recovery php artisan vendor:publish --tag="rebel-recovery-migrations" php artisan migrate ``` --- Usage ----- [](#usage) ``` use Padosoft\Rebel\Recovery\RecoveryCodeManager; $recovery = app(RecoveryCodeManager::class); // At enrolment: generate and SHOW ONCE (cannot be retrieved again) $codes = $recovery->generate($user, count: 10); // → ["A1B2-C3D4-E5F6-G7H8-J9K0", ...] display/download these now // Later: the user submits one code to recover access if ($recovery->verify($user, $request->string('code'))) { // consumed — let them through (ideally behind a high-assurance step-up) } $recovery->remaining($user); // how many codes are left ``` --- Security notes -------------- [](#security-notes) - **Never stored in plaintext**: only a keyed HMAC of `(salt|code)` with a `key_version`. - **Single-use & atomic**: a row lock guarantees a code can be redeemed once. - **Constant-time**: the whole candidate set is checked, no early-exit timing leak. - **No built-in lockout**: recovery codes are a *lookup secret* — put your app's brute-force throttle in front of `verify()` (and treat repeated failures as an anti-ATO signal). - **Multi-tenant**: rows are scoped via the core tenant scope — resolve the current tenant per request in multi-tenant deployments so codes never cross tenants. --- `.env.example` -------------- [](#envexample) ``` REBEL_RECOVERY_CODE_COUNT=10 ``` --- 🔋 Vibe coding with batteries included ------------------------------------- [](#-vibe-coding-with-batteries-included) This package ships **AI batteries** — so you (and your AI agent) can extend it correctly on the first try: - **`CLAUDE.md`** — a concise AI working guide (purpose, conventions, architecture, how to extend, Definition of Done). Plain Markdown, so Claude Code, Cursor, Copilot and Codex all read it. - **`AGENTS.md`** — the agent/workflow contract (branch → PR → CI → tag/release, the gates). - **`.claude/skills/`** — invocable skills (at least `rebel-package-dev`) encoding the suite's TDD loop, the **PHPStan-level-max** recipes, the security/telemetry rules, and the release discipline. Open the repo in your AI editor and just start — the rules, guardrails and extension recipes come with it. PRs that follow the shipped `CLAUDE.md` pass CI (PHPStan max + Pest + Pint) and review the first time around. --- Testing & License --------------------- [](#testing--license) ``` composer test # Pest (generate, single-use verify, reuse, regenerate, per-subject, normalization) composer phpstan # static analysis, level max composer pint # code style ``` **License:** MIT — see [LICENSE](LICENSE). Part of the [`padosoft/laravel-rebel`](https://github.com/padosoft) suite. ### Health Score 40 — FairBetter than 86% of packages Maintenance91 Actively maintained with recent releases Popularity11 Limited adoption so far Community8 Small or concentrated contributor base Maturity41 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 51d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/10467699?v=4)[Lorenzo](/maintainers/lopadova)[@lopadova](https://github.com/lopadova) --- Top Contributors [![lopadova](https://avatars.githubusercontent.com/u/10467699?v=4)](https://github.com/lopadova "lopadova (6 commits)") --- Tags laravelsecurityAuthenticationpadosoftRebel ### Code Quality TestsPest Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/padosoft-laravel-rebel-recovery/health.svg) ``` [![Health](https://phpackages.com/badges/padosoft-laravel-rebel-recovery/health.svg)](https://phpackages.com/packages/padosoft-laravel-rebel-recovery) ``` ### Alternatives [spatie/laravel-permission Permission handling for Laravel 12 and up 12.9k102.4M1.5k](/packages/spatie-laravel-permission)[defstudio/telegraph A laravel facade to interact with Telegram Bots 813336.8k3](/packages/defstudio-telegraph)[harris21/laravel-fuse Circuit breaker for Laravel queue jobs. Protect your workers from cascading failures. 45955.7k](/packages/harris21-laravel-fuse)[rawilk/profile-filament-plugin Profile & MFA starter kit for filament. 3914.8k](/packages/rawilk-profile-filament-plugin)[masterix21/laravel-licensing Laravel licensing package with polymorphic assignment to any model, activation keys, expirations/renewals, and seat control via LicenseUsage. Supports offline verification with public-key–signed tokens, a CLI to generate/rotate/revoke keys, and an extensible architecture via config and contracts. 1613.3k4](/packages/masterix21-laravel-licensing)[simplestats-io/laravel-client Server-side analytics for Laravel that follows the full funnel from visit to registration to payment, attributed to the channel that drove it. Revenue, MRR, churn and ad-spend profit (ROAS/CAC) per channel. GDPR compliant, ad-blocker proof. 5022.6k](/packages/simplestats-io-laravel-client) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)