PHPackages rdtvaacar/google2fa - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. rdtvaacar/google2fa ActiveLibrary[Authentication & Authorization](/categories/authentication) rdtvaacar/google2fa =================== A One Time Password Authentication package, compatible with Google Authenticator. 06PHP Since Mar 9Pushed 5y ago1 watchersCompare [ Source](https://github.com/rdtvaacar/google2fa)[ Packagist](https://packagist.org/packages/rdtvaacar/google2fa)[ RSS](/packages/rdtvaacar-google2fa/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependenciesVersions (1)Used By (0) Google2FA ========= [](#google2fa) [![Latest Stable Version](https://camo.githubusercontent.com/efd3b8a655bcd0cf13052eaefba597c71a0a394e2f8c1ce7567b70ec5b2e276f/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f7264747661616361722f676f6f676c653266612e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/rdtvaacar/google2fa) [![License](https://camo.githubusercontent.com/a7d953c880516e66cbc40f3833498c010255e60ca0142114a22829dc66fe28e4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4253445f335f436c617573652d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE) [![Downloads](https://camo.githubusercontent.com/86a9783a764d5fa80321da3d7b598e9302d3194b99caca70bc03017fc52f46d3/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f7264747661616361722f676f6f676c653266612e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/rdtvaacar/google2fa) ### Google Two-Factor Authentication for PHP Package [](#google-two-factor-authentication-for-php-package) Google2FA is a PHP implementation of the Google Two-Factor Authentication Module, supporting the HMAC-Based One-time Password (HOTP) algorithm specified in [RFC 4226](https://tools.ietf.org/html/rfc4226) and the Time-based One-time Password (TOTP) algorithm specified in [RFC 6238](https://tools.ietf.org/html/rfc6238). This package is agnostic, but also supports the Laravel Framework. Requirements ------------ [](#requirements) - PHP 5.3.7+ Compatibility ------------- [](#compatibility) You don't need Laravel to use it, but it's compatible with - Laravel 4.1+ - Laravel 5+ Installing ---------- [](#installing) Use Composer to install it: ``` composer require rdtvaacar/google2fa ``` If you prefer inline QRCodes instead of a Google generated url, you'll need to install [BaconQrCode](https://github.com/Bacon/BaconQrCode): ``` composer require "bacon/bacon-qr-code":"~1.0" ``` Installing on Laravel --------------------- [](#installing-on-laravel) Add the Service Provider and Facade alias to your `app/config/app.php` (Laravel 4.x) or `config/app.php` (Laravel 5.x): ``` Rdtvaacar\Google2FA\Vendor\Laravel\ServiceProvider::class, 'Google2FA' => Rdtvaacar\Google2FA\Vendor\Laravel\Facade::class, ``` Using It -------- [](#using-it) #### Instantiate it directly [](#instantiate-it-directly) ``` use Rdtvaacar\Google2FA\Google2FA; $google2fa = new Google2FA(); return $google2fa->generateSecretKey(); ``` #### In Laravel you can use the IoC Container and the contract [](#in-laravel-you-can-use-the-ioc-container-and-the-contract) ``` $google2fa = app()->make('Rdtvaacar\Google2FA\Contracts\Google2FA'); return $google2fa->generateSecretKey(); ``` #### Or Method Injection, in Laravel 5 [](#or-method-injection-in-laravel-5) ``` use Rdtvaacar\Google2FA\Contracts\Google2FA; class WelcomeController extends Controller { public function generateKey(Google2FA $google2fa) { return $google2fa->generateSecretKey(); } } ``` #### Or the Facade [](#or-the-facade) ``` return Google2FA::generateSecretKey(); ``` How To Generate And Use Two Factor Authentication ------------------------------------------------- [](#how-to-generate-and-use-two-factor-authentication) Generate a secret key for your user and save it: ``` $user = User::find(1); $user->google2fa_secret = Google2FA::generateSecretKey(); $user->save(); ``` Show the QR code to your user: ``` $google2fa_url = Google2FA::getQRCodeGoogleUrl( 'YourCompany', $user->email, $user->google2fa_secret ); {{ HTML::image($google2fa_url) }} ``` And they should see and scan the QR code to their applications: [![QRCode](https://camo.githubusercontent.com/b452d09f2effb9718266d946358d3971141f825635da0c4383a6784d8f93463c/68747470733a2f2f63686172742e676f6f676c65617069732e636f6d2f63686172743f6368733d323030783230302663686c643d4d25374330266368743d71722663686c3d6f747061757468253341253246253246746f7470253246507261676d615258253341616372253242707261676d617278253430616e746f6e696f6361726c6f737269626569726f2e636f6d2533467365637265742533444144554d4a4f353633344e5044454b57253236697373756572253344507261676d615258)](https://camo.githubusercontent.com/b452d09f2effb9718266d946358d3971141f825635da0c4383a6784d8f93463c/68747470733a2f2f63686172742e676f6f676c65617069732e636f6d2f63686172743f6368733d323030783230302663686c643d4d25374330266368743d71722663686c3d6f747061757468253341253246253246746f7470253246507261676d615258253341616372253242707261676d617278253430616e746f6e696f6361726c6f737269626569726f2e636f6d2533467365637265742533444144554d4a4f353633344e5044454b57253236697373756572253344507261676d615258) And to verify, you just have to: ``` $secret = Input::get('secret'); $valid = Google2FA::verifyKey($user->google2fa_secret, $secret); ``` Server Time ----------- [](#server-time) It's really important that you keep your server time in sync with some NTP server, on Ubuntu you can add this to the crontab: ``` ntpdate ntp.ubuntu.com ``` Using a Bigger and Prefixing the Secret Key ------------------------------------------- [](#using-a-bigger-and-prefixing-the-secret-key) Although the probability of collision of a 16 bytes (128 bits) random string is very low, you can harden it by: #### Use a bigger key [](#use-a-bigger-key) ``` $secretKey = $google2fa->generateSecretKey(32); // defaults to 16 bytes ``` #### Prefix it [](#prefix-it) ``` $secretKey = $google2fa->generateSecretKey(16, $userId); ``` Demos ----- [](#demos) Here's a demo app showing how to use Google2FA: [google2fa-example](https://github.com/antonioribeiro/google2fa-example). You can scan the QR code on [this page](https://antoniocarlosribeiro.com/technology/google2fa) with a Google Authenticator app and view the code changing (almost) in real time. Google Authenticator Apps: -------------------------- [](#google-authenticator-apps) To use the two factor authentication, your user will have to install a Google Authenticator compatible app, those are some of the currently available: - [Authy for iOS, Android, Chrome, OS X](https://www.authy.com/) - [FreeOTP for iOS, Android and Peeble](https://fedorahosted.org/freeotp/) - [FreeOTP for iOS, Android and Peeble](https://www.toopher.com/) - [Google Authenticator for iOS](http://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8%22) - [Google Authenticator for Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2%22) - [Google Authenticator for Blackberry](https://m.google.com/authenticator%22) - [Google Authenticator (port) on Windows app store](http://apps.microsoft.com/windows/en-us/app/google-authenticator/7ea6de74-dddb-47df-92cb-40afac4d38bb%22) - [Microsoft Authenticator for Windows Phone](https://www.microsoft.com/en-us/store/apps/authenticator/9wzdncrfj3rj) - [1Password for iOS, Android, OSX, Windows](https://1password.com) Tests ----- [](#tests) The package tests were written with [phpspec](http://www.phpspec.net/en/latest/). Author ------ [](#author) [Antonio Carlos Ribeiro](http://twitter.com/iantonioribeiro) License ------- [](#license) Google2FA is licensed under the BSD 3-Clause License - see the `LICENSE` file for details Contributing ------------ [](#contributing) Pull requests and issues are more than welcome. ### Health Score 17 — LowBetter than 6% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity4 Limited adoption so far Community7 Small or concentrated contributor base Maturity31 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://www.gravatar.com/avatar/286fe1af829a5e5b5420cc161756595145eec530dce86314a57dbb883d44f5cc?d=identicon)[rdtvaacar](/maintainers/rdtvaacar) --- Top Contributors [![rdtvaacar](https://avatars.githubusercontent.com/u/3095828?v=4)](https://github.com/rdtvaacar "rdtvaacar (2 commits)") ### Embed Badge ![Health badge](/badges/rdtvaacar-google2fa/health.svg) ``` [![Health](https://phpackages.com/badges/rdtvaacar-google2fa/health.svg)](https://phpackages.com/packages/rdtvaacar-google2fa) ``` ### Alternatives [tg/tgwebvalid An easy way to validate Telegram Login Widget and Telegram Mini App users on your website using PHP 6827.5k1](/packages/tg-tgwebvalid)[vitalybaev/laravel5-dkim Laravel 5/6 package for signing outgoing messages with DKIM. 3163.1k](/packages/vitalybaev-laravel5-dkim)[kissdigital-com/apple-sign-in-client-secret-generator PHP package for generating 'client secret' for Sign In with Apple 2125.5k](/packages/kissdigital-com-apple-sign-in-client-secret-generator)[denniseilander/laravel-passport-scopes-restriction Restrict scopes for different Laravel Passport clients. 1636.3k](/packages/denniseilander-laravel-passport-scopes-restriction) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)