Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
This repository is a browser extension for generating two-factor authentication (2FA) TOTP and HOTP codes. It allows users to securely store account secrets (optionally encrypted with a passphrase), generate codes for login, and provides features such as autofill into web pages, cloud backups (Dropbox, Google Drive, OneDrive), and synchronization across browsers. The extension is built with TypeScript and Vue 2.x, using Webpack for bundling and Vuex for state management. It supports multiple browsers (Chrome, Firefox, Edge) and manifests for Manifest V3. The architecture consists of a background service worker (for handling events and cloud sync), a popup UI (for displaying codes and managing accounts), an options page (for settings), content scripts (for autofill and QR code scanning), and an import page. Data flows involve storing encrypted account secrets in browser storage, generating OTPs from these secrets, and securely backing up and restoring data via cloud services or encrypted files. External dependencies include browser APIs, cloud service APIs (OAuth), and cryptographic libraries (argon2-browser, crypto-js, node-gost-crypto). The codebase demonstrates good engineering practices with clear separation of concerns, reusable abstractions for encryption and storage, and a modular structure for UI components and cloud backup providers. It includes internationalization support, a security advisor for recommendations, and a test suite (unit and end-to-end). While the project faces some technical debt due to its reliance on Vue 2.x and complex backup integrations, it remains actively maintained and functional.
Google2FA is a standalone PHP library implementing the Time-based One-Time Password (TOTP) algorithm as specified in RFC 6238, fully compatible with Google Authenticator and similar authenticator apps. It provides secure secret key generation (base32-encoded), HMAC-based OTP computation with configurable algorithms (SHA1, SHA256, SHA512), and OTP verification with a sliding window to accommodate clock drift. The library also includes a helper for generating otpauth:// URLs for QR code integration. It has zero external runtime dependencies beyond a constant-time base32 encoder and is designed as a single-class library with traits for modularity. The codebase is well-tested across PHP 7.4 to 8.6 (beta), employs static analysis (PHPStan, Psalm), and follows a clean, maintainable architecture with clear exception hierarchies. It is not a framework but can be used in any PHP project.
java-otp is a Java library for generating HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords. The core functionality resides in two thread-safe classes: HmacOneTimePasswordGenerator for HMAC-based OTPs and TimeBasedOneTimePasswordGenerator for time-based OTPs. The library depends only on the Java standard library, with JUnit and JMH used solely for testing and benchmarking. Entry points include the constructors and methods like generateOneTimePassword and validateOneTimePassword. Data flow involves passing a SecretKey and counter/timestamp to generate or validate OTPs. The architecture is a simple, focused library with no external services or complex dependencies.
This repository contains Stratum, a free and open-source two-factor authentication (2FA) app for Android with Wear OS support. It implements TOTP, HOTP, Steam, Yandex, and mOTP code generation algorithms with configurable parameters. The app features encrypted local backups with AES-GCM/CBC and Argon2id/PBKDF2 key derivation, import from over 15 third-party authenticator apps (Aegis, Bitwarden, KeePass, etc.), QR code scanning via CameraX, and a Material Design 3 UI. The architecture follows a clean layered pattern with a core library (Stratum.Core) containing domain entities, OTP generators, backup converters, and service interfaces, a Droid project for the phone UI, and a Wear OS project. The codebase is well-organized with dependency injection (Autofac), repository pattern for SQLite persistence, and unit tests. It demonstrates strong data engineering skills in reverse-engineering and parsing various backup formats, implementing custom cryptography for Ente Auth, and maintaining a large icon database. The project is actively maintained, targets .NET 10, and has localization in 27+ languages.
This repository provides a Pluggable Authentication Module (PAM) for two-factor authentication using TOTP (RFC 6238) and HOTP (RFC 4226) one-time passwords. It consists of a PAM shared library (`pam_google_authenticator.so`) that integrates with any PAM-aware service (SSH, login, etc.) to require a verification code in addition to the user's password, and a command-line tool (`google-authenticator`) for generating secret keys and configuring per-user state files. The implementation is written in C using autotools for building, and includes self-contained cryptographic primitives (Base32 encoding, HMAC-SHA1, SHA-1) that are also reused across the PAM module and the CLI tool. The code is well-structured, with careful attention to security (explicit memory zeroing, file permission checks, rate limiting, and reuse prevention). While the build system and CI (Travis CI) are somewhat dated, the core functionality is mature and actively maintained.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.