Repository navigation
Secrets that do not decode are refused, and codes are compared strictly.
Package Changes
CHANGE: getCode(), and so getCodesInRange() and checkCode(), throw InvalidArgumentException when the secret is shorter than 16 characters or contains anything outside the Base32 alphabet. Previously such a secret was hashed as an empty key and still produced codes.
CHANGE: checkCode() compares with in_array(..., true), so only the exact 6-digit string matches. Numeric look-alikes such as "12345" for "012345" are no longer accepted.
IMPROVEMENT: The Base32 decoder validates every character and regroups the bit stream per RFC 4648, so secrets whose length is not a multiple of 8 decode without warnings.
IMPROVEMENT: declare(strict_types=1) is enabled in the library. Callers are unaffected.
Supporting Changes
TESTS: Added the RFC 6238 SHA-1 test vectors, rejected-secret cases, and a strict-comparison case. 26 tests on PHP 8.2 to 8.6.
DOCS: The README drops the BlackBerry link and updates the iOS one; the Composer keyword 2fa webauthn is now 2fa.
Full Changelog: 4.2...4.3