Download the PHP package prasanth-j/otpify without Composer

Otpify

A secure, flexible OTP (One-Time Password) package for Laravel. Supports database and cache storage drivers, multiple purposes per identifier, hashed token storage, events, and a ready-made validation rule.

Requirements

• PHP 8.1+
• Laravel 9, 10, 11, 12, or 13

Each Laravel major has its own PHP range and support window (per Laravel's official support policy), so the actual floor depends on which Laravel version you're on:

Laravel 9, 10, and 11 no longer receive security fixes upstream. This package still works on them, but for new projects prefer Laravel 12 or 13.

Installation

Publish the config file:

If you plan to use the database driver (the default), publish and run the migration:

Configuration

config/otpify.php:

Security

• OTPs are generated with random_int(), never mt_rand().
• Only the SHA-256 hash of the OTP is stored (hash('sha256', $token)) — the plaintext is never persisted.
• Validation compares hashes with hash_equals() for constant-time comparison.
• The plaintext token is only ever returned once, from generate()/resend(), so you can send it via email/SMS/etc. validate() never returns the token.
• OTPs are single-use: a successful validate() call immediately invalidates the OTP.

Usage

Generate an OTP

With a purpose and custom options:

Generating a new OTP for the same identifier + purpose deletes any previous one — only the latest OTP for a given identifier/purpose is ever valid.

Validate an OTP

OtpResult status values and helpers:

Invalidate an OTP

Resend an OTP

Invalidates any existing OTP for the identifier/purpose and generates a fresh one:

Multiple purposes

Every method accepts a purpose so the same identifier can hold independent OTPs at once, e.g. 'login', '2fa', 'password-reset'.

Validation rule

Use OtpRule to validate an OTP as part of a normal Laravel form request or validator:

Events

Drivers

Database (default)

Stores hashed OTPs in the otpify_tokens table. Requires the migration to be run. Good default choice — durable, works with the otpify:clean command.

Cache

Stores hashed OTPs in your configured cache store under otpify:{identifier}:{purpose}, using the OTP's expiry as the cache TTL. No migration needed; good fit if you already run Redis/Memcached and don't need a durable audit trail.

Rate limiting

Otpify does not rate limit generation/validation attempts itself — pair it with Laravel's RateLimiter:

Do the same around Otpify::validate() to slow down brute-force guessing attempts.

Cleaning up expired tokens

For the database driver, expired and used rows accumulate over time. Clean them up with:

Schedule it in routes/console.php (Laravel 11+) or app/Console/Kernel.php (Laravel 9/10):

This command is a no-op (with a warning) when the cache driver is active, since cache entries expire on their own via TTL.

Migrating from v1

v2.0.0 is a full rewrite and breaking change:

• The otps table and Otp model are gone, replaced by the otpify_tokens table (no model).
• Otpify::generate()/validate() now return an OtpResult object instead of an array.
• Otpify::generate() signature changed from generate(string $identifier, int $userId = null, string $otpType = null, int $digits = null, int $validity = null) to generate(string $identifier, string $purpose = 'default', array $options = []).
• otpType is now purpose, and is a required-shaped concept everywhere (defaults to 'default').
• OTPs are now stored hashed (SHA-256) instead of in plaintext.
• user_id is no longer stored — key OTPs by whatever identifier makes sense for you (email, phone, user ID as a string, etc.).

If you have existing data in the old otps table, write a one-off migration to hash and copy identifier/otp_type/token/expiry data into otpify_tokens, or simply let outstanding OTPs expire naturally and drop the old table.

Development

Larastan 3.x requires PHP 8.2+ locally to run static analysis, even though the package itself supports PHP 8.1+.

License

MIT