Spomky-Labs/otphp for RFC 4226 and RFC 6238 one-time passwords

otphp solves one-time password generation inside PHP applications

Spomky-Labs/otphp addresses a narrow but common authentication task: generating one-time passwords according to established RFC definitions. The README identifies RFC 4226 as the basis for HOTP and RFC 6238 as the basis for TOTP. That distinction matters because the library is not an application for scanning QR codes, managing accounts, or deciding when a user should be authenticated. It provides the generation layer that an application can use when it already has the relevant shared secret and algorithm settings.

The intended users are PHP developers building or extending an authentication system that needs HOTP or TOTP generation. The stated compatibility with Google Authenticator apps for Android and iPhone, and with applications such as FreeOTP, connects the generated values to a broader authenticator ecosystem. It does not mean that otphp manages those applications. Enrollment, device registration, secret delivery, account recovery, and user interface decisions remain responsibilities outside the narrow library boundary described by the README.

There is also an important operational distinction between the two RFCs. HOTP is described by the project as the RFC 4226 algorithm, while TOTP follows RFC 6238. The README does not document the library's API, configuration objects, counters, time intervals, digit counts, or secret types, so an application cannot be designed from this README alone. The repository layout does, however, point to a conventional PHP package with source code under `src/`, tests under `tests/`, and project-specific documentation under `doc/`.

HOTP and TOTP generation follow separate RFC paths

The clearest confirmed mechanism is the RFC-based separation between HOTP and TOTP. RFC 4226 supplies the HOTP algorithm identified by the README, while RFC 6238 supplies the TOTP algorithm. otphp packages these standards as PHP functionality rather than presenting an unrelated custom OTP format. This makes the RFC identifiers the first technical fact to check when deciding whether the package matches an existing authenticator integration.

The README does not expose the implementation details, so it would be inaccurate to claim a particular PHP class, method, hash algorithm, numeric conversion path, or code layout. The repository does contain `src/`, but the file names and contents were not provided in the README. Likewise, the tests directory indicates that the project has a test area, yet no test command or coverage result appears in the README. The documentation states that compatibility with Google Authenticator and FreeOTP exists, but it does not enumerate every authenticator configuration that has been checked.

For a developer, the practical implication is that compatibility must be configured consistently on both sides. A PHP service generating a value and an authenticator app verifying it need compatible OTP assumptions. The README does not state which assumptions otphp exposes, so the first source-level check should be the project documentation and API declarations under `doc/` and `src/`. The presence of RFC 4226 and RFC 6238 repository topics supports the standards compatibility claim, but topics are classification rather than proof of any particular integration test.

The README points to `doc/index.md` instead of giving installation steps

The project does not provide install instructions in the README excerpt. It says that documentation is available in the `doc` folder and specifically identifies `doc/index.md`. The README also links to Packagist through its badges, which identifies the package distribution channel, but it does not show the Composer command or the required package name. Inventing either would risk sending an engineer to a dependency name or installation form that is not confirmed.

A first real use therefore cannot be reproduced from the README alone. There is no example secret, OTP URI, parameter set, PHP class, method call, or verification example in the README. It would be misleading to provide a code block that looks plausible but cannot be traced to the documented API.

The available next step is to open `doc/index.md`, then inspect `composer.json` for the package metadata and PHP constraints. Those are concrete project files, unlike an invented installation command. The source and tests can then be read to identify the supported HOTP and TOTP configuration surface before writing application code. This documentation gap is a real adoption cost for a library whose README is mostly a project summary, standards reference, support note, contribution link, and licence statement.

otphp leaves authentication policy outside the generation library

The biggest limitation is scope. otphp is described as a library for generating one-time passwords, not as a complete second-factor authentication service. The README does not document server-side verification, replay protection, counter or time-window policy, rate limiting, account recovery, shared-secret encryption, provisioning, revocation, or audit logging. Those omissions are not proof that every feature is absent from the implementation, but they are not documented, and the article cannot claim them as available.

This matters because an OTP generator alone does not establish an authentication workflow. A TOTP integration also needs to decide how the shared secret reaches a user's authenticator. A HOTP integration needs a defined counter progression. The README identifies the relevant RFCs but does not explain how otphp exposes those settings or whether it handles replay and verification decisions. The library should therefore be evaluated as a building block, not as a turnkey security control.

The compatibility claim also needs careful interpretation. Google Authenticator and FreeOTP are named as applications with which the library is compatible. That is useful evidence for ecosystem intent, but the README does not document tested versions, supported platforms, QR provisioning behavior, or migration behavior when an authenticator changes a secret. Engineers should verify the documented API and test cases for the exact enrollment and verification path they intend to build.

PHP package history is recent, while upgrade policy remains undocumented

The repository is not archived, and its recorded last push was on 2026-10-01. Recent release entries include `11.5.0` on 2026-06-06, `11.4.3` on 2026-05-31, and `11.4.2` on 2026-01-23. Those dates show recent release activity around the current project state. The default branch is named `11.6.x`, while the listed releases are in the 11.4 and 11.5 lines, so branch selection should be checked rather than inferred from the release list.

The README does not document a semantic-versioning policy, supported PHP range, migration guide, upgrade command, deprecation schedule, or compatibility matrix. `RELEASES.md` is present at the repository root, but its contents are not included in the README, so no specific upgrade procedure can be reported. An application should inspect that file and `composer.json` before choosing a release line.

The package is released under the MIT licence, and the repository includes a `LICENSE` file. MIT is permissive, but the actual obligations and compatibility with a project's other dependencies should be checked by the responsible project owner. The licence does not by itself answer questions about secret handling, device support, or the security consequences of an incorrect OTP implementation.

A custom OTP implementation is the main alternative

The direct alternative is to implement HOTP or TOTP inside the application using a cryptographic OTP package or a service designed for authentication. The difference is architectural. otphp is a focused PHP library tied to RFC 4226 and RFC 6238, whereas an external authentication service or a different OTP package may provide a broader workflow, a different programming interface, or separate storage and verification components. The README does not name a specific competitor, so it would be inaccurate to describe one product's feature set.

otphp is the narrower choice when the application deliberately wants RFC-compatible generation in PHP and is prepared to handle the surrounding authentication policy. A custom implementation would be a poor substitute if it duplicates standard OTP mathematics without equivalent tests. Conversely, the library is the wrong choice when the requirement includes enrollment, recovery, secret lifecycle management, or complete second-factor policy but those needs are expected to come from the OTP package itself.

The decision should be based on API clarity and integration boundaries. Inspect `doc/index.md` and `src/` for the actual parameter model, then compare that with the application's existing authentication and secret-storage components. The README alone does not establish which alternative is cheaper or safer.

Editorial conclusion

Adopt otphp when a PHP application needs a focused HOTP or TOTP generator and can provide the RFC-compatible parameters required by its users. Do not treat it as a complete authentication product, because the README and repository files do not document enrollment, secret storage, recovery, drift handling, replay protection, or rollback. Before adoption, inspect `doc/index.md`, `composer.json`, and the public interfaces under `src/` to confirm the supported PHP version, package constraints, OTP configuration model, and licensing fit.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. Releases
5. Spomky-Labs/otphp on GitHub