OTP means "One Time Password" and is a webtool to share passwords and secret. The password will be saved encrypted in a database and a link for this will be generated. You can share this link via mail or messenger. Once the password is accessed, it will be deleted from the database and can't be retrieved again.
If the link does not work, you know that the password is compromised and should be changed immediately.
You can try it here: https://otp.rodnoc.eu
You need at least PHP 7.4, but I developed and tested it with 8.1. And you need a MySQL or MariaDB-Database
Please upload all files to your webspace and create this table in your database:
CREATE TABLE `password` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`hash` varchar(25) NOT NULL,
`token` varchar(255) DEFAULT NULL,
`created` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
`used` timestamp NULL DEFAULT NULL,
PRIMARY KEY (`id`)
) DEFAULT CHARSET=latin1;
After this add your configuration to libs/config.php
//Show link to share a password on the landing page (true/false)
$config["app"]["showcreate"]=true;
//Credentials for the database connection (MySQL)
$config["db"]["host"] = "localhost";
$config["db"]["user"] = "otp_user";
$config["db"]["pass"] = "password";
$config["db"]["name"] = "otp_db";
$config["db"]["charset"] = "latin1";
//more entropy for the password-link? true or false
$config["token"]["more_entropy"] = true;
//URLs to social-media. Can be the URL or false
$config["social"]["twitter"] = "https://twitter.com/rodnoc42";
$config["social"]["instagram"] = false;
$config["social"]["facebook"] = false;
//The secret for sodium
$config["app"]["secret"]="f091af0f0462172c3e049e5a1b94900ce7019adb13cee4e4c11e20dfa5d37c37";
To generate the secret for sodium, you can use this command on a CLI.
php <<EOF
<?php
echo sodium_bin2hex(sodium_crypto_secretbox_keygen());
?>
EOF
Enter your password on https://otp.domain.local/create/. After a click on "Save it!" the URL to the password is listed. You can share this link via mail or messenger. The recipient can open this URL and when the password is not received yet, he can click on "Request it!" and the password is shown. When anyone uses the Link again, there is a information with the timestamp the password was accessed.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent