Two-factor authentication for Laravel Nova 5: authenticator apps, passkeys, email codes and recovery codes, with enforcement policies, step-up re-authentication, trusted devices and admin oversight.

Installation, every configuration option, a builder that writes your .env, an enforcement simulator, and every screen in both themes.

Nova ships two-factor authentication of its own through Laravel Fortify. If authenticator applications and recovery codes for users who opt in are all you need, use it. This package exists for what that cannot do:

• Passkeys and email one-time codes, alongside authenticator apps.
• More than one method per user, so a lost phone is not a lost account.
• Mandatory enrollment with a grace period, and per-role targeting.
• Step-up re-authentication in front of dangerous actions.
• Trusted devices, an audit trail, and three administration pages.

Recovery codes are hashed individually, TOTP replay is refused, and QR codes are generated locally — there is no remote code path.

• PHP 8.2+ (8.3+ for Laravel 13)
• Laravel 11, 12 or 13
• Nova 5.7+ (5.11+ for Laravel 13)
• https in production. Passkeys require a secure context; localhost is exempt.

composer require gabrielesbaiz/nova-two-factor

php artisan vendor:publish --tag=nova-two-factor-migrations
php artisan migrate
php artisan vendor:publish --tag=nova-two-factor-config
php artisan vendor:publish --tag=nova-two-factor-assets

php artisan nova-two-factor:doctor

Then add the HasTwoFactorAuthentication trait to your authenticatable models and register NovaTwoFactor::make() in your NovaServiceProvider. Fortify's updatePasswords and twoFactorAuthentication features must stay enabled.

Full installation guide →

composer test        # Pest
composer analyse     # PHPStan
composer format      # Pint

The suite includes a regression test for every vulnerability found in 1.x.

Thank you for considering contributing. The guide is in CONTRIBUTING.md.

Please review SECURITY.md for reporting a vulnerability. Please do not open a public issue.

Written and maintained by Gabriele Sbaiz.

This package builds on Laravel, Nova, Fortify, web-auth/webauthn-lib, pragmarx/google2fa, bacon/bacon-qr-code, spatie/laravel-package-tools, and the WebAuthn and TOTP specifications.

If it is useful to you:

• ⭐ Star the repo. Free, thirty seconds, and it is the first signal other developers look at.
• ❤️ Become a sponsor. From $5 a month.
• 🐛 Open a good issue. A clear reproduction is worth more than you think.
• 🗣️ Tell another Laravel developer. Word of mouth is how packages survive.

This package is provided as is, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, title and non-infringement. To the fullest extent permitted by applicable law, in no event shall the authors, copyright holders or contributors be liable for any claim, damages or other liability — whether in an action of contract, tort or otherwise — arising from, out of or in connection with this package or its use, including without limitation any direct, indirect, incidental, special, exemplary, consequential or punitive damages, loss of data, loss of profits, business interruption, account lockouts, unauthorised access, or failure of any authentication control.

Two-factor authentication is a security control: whoever deploys it is responsible for it. That responsibility includes, and is not limited to, choosing appropriate configuration, running nova-two-factor:doctor before relying on it, testing enforcement and recovery on your own infrastructure, keeping recovery paths available to your users, meeting whatever regulatory or contractual obligations apply to you, and reviewing the code yourself before putting it in front of an account you cannot afford to lose. Nothing here constitutes security, legal or compliance advice, and no claim is made that this package makes any system, application or organisation secure or compliant with any standard.

Use of this package is entirely at your own risk.

MIT. See LICENSE.md. The MIT licence's warranty disclaimer and limitation of liability apply in full, alongside the disclaimer above.