A simple PHP script to create TOTP secrets and corresponding QR codes,
then verify the entered response over a given time variance.
homepage
documentation
glossary
server
source
Information
Create a new Secret and get the QR Code all in one.
Code
Authenticatron::new(string $accountName, string $issuer): array
Input
$accountName
is a string containing the data your member will identify with.
$issuer
is a string containing the name of your app or site.
Output
Outputs an array, where Secret
is the Secret for the member, URL
is an OTPAuth URL, and QR
is the Data64 URI for the QR code.
array(3) { ["Secret"]=> string(16) "IMMVDW4E3AADCNS7" ["URL"]=> string(102) "otpauth://totp/Documentation Example: Member Name?secret=IMMVDW4E3AADCNS7&issuer=Documentation+Example" ["QR"]=> string(638) "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKQAAACkAQMAAAAjexcCAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABbklEQVRIidWWURKDMAhEuQH3vyU3oLwldux39qdqbXxxJmZhSSL+7ejuysiikVE8Wuj8qpOTV6pEHHRa2QNmuLmVOky0M7OGpZlGFQrl/PlowCJGnoqMl2Z3lPC9jleM7+jJNroZ7TcHL+g8cKXUl/4mWuRd1pwDpm2iCELiTSwlFeI76IQRGHpMFDJRuaRzI5n1RPOWZooo/xAJRzpoE0PcQkfrHQsliEn2YZXxt4sy3qlF5N5OyEALfULqkCi5gxnofHbicOU37fJQPC1RcnMwTJTvJjlKntmoGih+pik+3bHZd03lkTj5l6pKFhpam7nmFkjkoaWH2DnU424DlflQZ5fpo849pVpoEpR7YloeerYppKBmlOGh6z1VN2nTHrp1eTuo9K81+oq2ltPGiNpfnJp6TWsLkkYktOWi2qxAW4tpnyrnoBR5tldof2JhodX1TCLju0e8pGvErcf1swe/ooom6uBsikZ76H8dHy2rJ1txJXx3AAAAAElFTkSuQmCC" }
Information
This returns a simple boolean value to prevent data-leakage and zero-equivalent values from codes or keys.
Code
Authenticatron::checkCode(string $code, string $secret, int $variance = 2): bool
Input
$code
is what the user enters to authenticate. A 6 digit string, usually numeric, but not necessarily an integer.
$secret
is the first result from new
, that you securely stored for later.
$variance
is an integer indicating the adjustment of codes with a 30 second value. Defaults to 2 either side, or 1 minute.
Output
Outputs a boolean value, true or false.
bool(true)
You should only need the two functions above this point to implement two-factor authentication.
Functions listed below this point should not need to be used in most production-ready environments.
Information
Generates a 16-digit secret, never to be shared with anyone except via internal non-cachable QR code.
Generated using RandomBytes if it is available, falling back to OpenSSL if it is secure.
RandomBytes is available.
OpenSSL is installed, and secure.
Your installation will use RandomBytes.
Code
Authenticatron::makeSecret(int $length = 16): ?string
Input
$length
should be an integer, longer than 16. Usually left to default.
Output
Returns a $length
long string with 32bit only Characters, or null
on failure (usually due to a lack of security).
Click the link to keep the secret the same when you refresh the page.
Information
Generates the URL for launching and adding the Secret we made earlier.
This link won't do anything unless you have a Authentication program on your computer.
Code
Authenticatron::getUrl(string $accountName, string $secret, string $issuer): string
Input
All parameters should be strings.
Output
Outputs an OTPAuth URL that gives people their Secret along with a passed Member Name and an optional Issuer.
otpauth://totp/Documentation Example: Member Name?secret=PDSKVORHGPQNGT3W&issuer=Documentation+Example
Information
Outputs a QR Code in Data64 for direct embedding from a given URL.
The GD functions are loaded.
Code
generateQrCode(string $URL, int $Size = 4, int $Margin = 2): ?string
Input
$URL
is a valid OTPAuth URL in string form.
$Size
is a non-zero integer, defaults to 4.
$Margin
is an integer, defaults to 2.
Output
Outputs a QR Code image in 64bit data-URI form.
Try scanning this QR code with your phone.
This should open an app like Google Authenticator.
Information
This is the current authentication code.
Check the Acceptable list to see the two either side.
Code
getCode(string $secret, int $timestamp = null, int $codeLength = 6): string
Input
$secret
is a valid Base32 Secret in string form.
$timestamp
is a unix timestamp, defaults to false to use the current timestamp.
$codeLength
is a non-zero integer, the desired length of the generated code. Defaults to 6.
Output
Outputs the calculated code for the current or provided timestamp.
string(6) "200480"
Information
This is the array checkCode
uses to check for valid codes.
Code
Authenticatron::getCodesInRange(string $secret, int $variance = 2): array
Input
$secret
is a valid Base32 Secret in string form.
$variance
is an integer indicating the adjustment of codes with a 30 second value. Defaults to 2, or 1 minute.
Output
Outputs the calculated code for the current or provided timestamp.
Note the indexes, which can be used to determine the time difference, and perhaps warn users on the outer bounds.
Code generation is expensive, so avoid generating any you don't want to check against later.
array(5) { [-2]=> string(6) "008242" [-1]=> string(6) "776720" [0]=> string(6) "200480" [1]=> string(6) "728663" [2]=> string(6) "475777" }
Your phone should produce one of these from the QR code above.
These are only valid for 30 seconds, so click the Secret link to get a new list.
Base32 is an encoding, effectively an alphabet, that computers use made up of 32 characters.
Base32 Characters are A to Z (upper-case only), and 2 to 7.
HOTP is HMAC-based one-time password algorithm. HOTP Algorithms generate passwords from a given secret that do not expose the secret over time.
OATH is the short name for the Initiative for Open Authentication, an organisation dedicated to keeping secure authentication free.
OTP Auth stands for one-time password authentication.
QR Code (Quick Response Code) is a type of 2D matrix barcodes with built in redundancy, commonly used to scan links into mobile phones through cameras.
TOTP abbreviates Time-based One-time Password Algorithm. TOTP Algorithms generate passwords from a given secret that are only valid over a very specific time period.
Visit our documentation for a more thorough description of the options and functions available to you.
Take a look at the glossary if there are any terms you don't understand.
The server page can be used if this script is installed on your server to check for requirements.
This work is predominantly MIT licensed. See the LICENSE.md file for more information.
If you're ready to rock, check out the source!