Google2FA is a standalone PHP library implementing the Time-based One-Time Password (TOTP) algorithm as specified in RFC 6238, fully compatible with Google Authenticator and similar authenticator apps. It provides secure secret key generation (base32-encoded), HMAC-based OTP computation with configurable algorithms (SHA1, SHA256, SHA512), and OTP verification with a sliding window to accommodate clock drift. The library also includes a helper for generating otpauth:// URLs for QR code integration. It has zero external runtime dependencies beyond a constant-time base32 encoder and is designed as a single-class library with traits for modularity. The codebase is well-tested across PHP 7.4 to 8.6 (beta), employs static analysis (PHPStan, Psalm), and follows a clean, maintainable architecture with clear exception hierarchies. It is not a framework but can be used in any PHP project.
This repository provides a Pluggable Authentication Module (PAM) for two-factor authentication using TOTP (RFC 6238) and HOTP (RFC 4226) one-time passwords. It consists of a PAM shared library (`pam_google_authenticator.so`) that integrates with any PAM-aware service (SSH, login, etc.) to require a verification code in addition to the user's password, and a command-line tool (`google-authenticator`) for generating secret keys and configuring per-user state files. The implementation is written in C using autotools for building, and includes self-contained cryptographic primitives (Base32 encoding, HMAC-SHA1, SHA-1) that are also reused across the PAM module and the CLI tool. The code is well-structured, with careful attention to security (explicit memory zeroing, file permission checks, rate limiting, and reuse prevention). While the build system and CI (Travis CI) are somewhat dated, the core functionality is mature and actively maintained.