PHP download

Download the PHP package olusegun171/laravel-mfa without Composer

On this page you can find all versions of the php package olusegun171/laravel-mfa. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download olusegun171/laravel-mfa
More information about olusegun171/laravel-mfa
Files in olusegun171/laravel-mfa

Vendor olusegun171
Package laravel-mfa
Short Description Multi-factor authentication for Laravel — TOTP compatible with Google Authenticator, Authy, and any RFC 6238 app.
License MIT
Homepage https://github.com/olusegun171/laravel-mfa

Keywords Authentication two-factor laravel totp 2fa MFA google-authenticator

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of olusegun171/laravel-mfa

Informations about the package laravel-mfa

laravel-mfa

Multi-factor authentication for Laravel. Works with Google Authenticator, Authy, 1Password, Bitwarden, and any other RFC 6238 compatible app.

Features

TOTP codes — RFC 6238 compliant, 6-digit, 30-second window
QR code URI generation for any authenticator app
AES-256-CBC encrypted secret storage
8 bcrypt-hashed one-time recovery codes
Clock-drift tolerance (±1 time-step)
TwoFactor facade + HasTwoFactor Eloquent trait

Requirements

PHP 8.1+
Laravel 10, 11, 12, or 13

Installation

The service provider and TwoFactor facade are registered automatically via package auto-discovery.

Setup

1. Publish the config

2. Run the migration

This adds three nullable columns to your users table:

Column	Description
`two_factor_secret`	AES-256-CBC encrypted TOTP secret
`two_factor_recovery_codes`	JSON array of bcrypt-hashed one-time backup codes
`two_factor_confirmed_at`	Timestamp set when the user confirms their first code

3. Add the trait to your model

Usage

See the Integration section for full usage examples split by authenticated and unauthenticated context.

Status Helpers

QR Code Identifier

By default the QR code label uses getAuthIdentifier() — typically the user's primary key. To show something friendlier (like an email address) in the authenticator app, add getTwoFactorIdentifier() to your model:

The label will appear as YourApp:[email protected] inside the authenticator app.

Configuration

Security Notes

Rate-limit the challenge endpoint — 5 attempts per minute is a reasonable starting point.
Serve over HTTPS — codes in transit must be encrypted.
Recovery codes are shown once — only bcrypt hashes are stored in the database.
All comparisons use hash_equals() for constant-time evaluation.
TOTP secrets are encrypted with AES-256-CBC using a 32-byte slice of your APP_KEY.
Never log two_factor_secret or two_factor_recovery_codes.

Integration

Authenticated context (settings or an enforced page)

The user is already logged in. They enable 2FA from their account settings or a dedicated page to enforce the 2fa, scan the QR code, and confirm with their first code.

Enable and show the QR code

Confirm the first code

Disable 2FA

Regenerate recovery codes

Unauthenticated context (login flow)

The user is not yet logged in. Auth::login() is not called until the 2FA code is verified — the user is fully unauthenticated between the password step and the code step.

Step 1 — Password check (LoginController)

Step 2 — Challenge routes

Wrap the challenge routes with the two-factor middleware so they redirect to login if accessed directly (no pending session).

Step 3 — Challenge controller

completeChallenge() clears the pending session state. The caller is responsible for Auth::login() and session()->regenerate().

License

MIT — see LICENSE

All versions of laravel-mfa with dependencies

PHP Build Version

Package Version

Version 1.0.0 Release 12. May 2026
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of laravel-mfa from vendor olusegun171

Requires php Version ^8.1
ext-openssl Version *
illuminate/console Version ^10.0|^11.0|^12.0|^13.0
illuminate/support Version ^10.0|^11.0|^12.0|^13.0

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package olusegun171/laravel-mfa contains the following files

Loading the files please wait ...