Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
Google2FA is a standalone PHP library implementing the Time-based One-Time Password (TOTP) algorithm as specified in RFC 6238, fully compatible with Google Authenticator and similar authenticator apps. It provides secure secret key generation (base32-encoded), HMAC-based OTP computation with configurable algorithms (SHA1, SHA256, SHA512), and OTP verification with a sliding window to accommodate clock drift. The library also includes a helper for generating otpauth:// URLs for QR code integration. It has zero external runtime dependencies beyond a constant-time base32 encoder and is designed as a single-class library with traits for modularity. The codebase is well-tested across PHP 7.4 to 8.6 (beta), employs static analysis (PHPStan, Psalm), and follows a clean, maintainable architecture with clear exception hierarchies. It is not a framework but can be used in any PHP project.
java-otp is a Java library for generating HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords. The core functionality resides in two thread-safe classes: HmacOneTimePasswordGenerator for HMAC-based OTPs and TimeBasedOneTimePasswordGenerator for time-based OTPs. The library depends only on the Java standard library, with JUnit and JMH used solely for testing and benchmarking. Entry points include the constructors and methods like generateOneTimePassword and validateOneTimePassword. Data flow involves passing a SecretKey and counter/timestamp to generate or validate OTPs. The architecture is a simple, focused library with no external services or complex dependencies.
This repository contains Stratum, a free and open-source two-factor authentication (2FA) app for Android with Wear OS support. It implements TOTP, HOTP, Steam, Yandex, and mOTP code generation algorithms with configurable parameters. The app features encrypted local backups with AES-GCM/CBC and Argon2id/PBKDF2 key derivation, import from over 15 third-party authenticator apps (Aegis, Bitwarden, KeePass, etc.), QR code scanning via CameraX, and a Material Design 3 UI. The architecture follows a clean layered pattern with a core library (Stratum.Core) containing domain entities, OTP generators, backup converters, and service interfaces, a Droid project for the phone UI, and a Wear OS project. The codebase is well-organized with dependency injection (Autofac), repository pattern for SQLite persistence, and unit tests. It demonstrates strong data engineering skills in reverse-engineering and parsing various backup formats, implementing custom cryptography for Ente Auth, and maintaining a large icon database. The project is actively maintained, targets .NET 10, and has localization in 27+ languages.
This repository provides a Pluggable Authentication Module (PAM) for two-factor authentication using TOTP (RFC 6238) and HOTP (RFC 4226) one-time passwords. It consists of a PAM shared library (`pam_google_authenticator.so`) that integrates with any PAM-aware service (SSH, login, etc.) to require a verification code in addition to the user's password, and a command-line tool (`google-authenticator`) for generating secret keys and configuring per-user state files. The implementation is written in C using autotools for building, and includes self-contained cryptographic primitives (Base32 encoding, HMAC-SHA1, SHA-1) that are also reused across the PAM module and the CLI tool. The code is well-structured, with careful attention to security (explicit memory zeroing, file permission checks, rate limiting, and reuse prevention). While the build system and CI (Travis CI) are somewhat dated, the core functionality is mature and actively maintained.