base32
A small, unglamorous library that a lot of things quietly depend on: RFC-compliant Base32 for PHP, still maintained after more than a decade.
Base32 is a niche encoding that turns out to be critical in exactly two places: cryptocurrency, and one-time passwords. The second one is why this exists. Back when I was working out how TOTP and HOTP actually function — the six digits in your authenticator app — I needed a Base32 implementation for PHP that followed the RFC properly. There wasn’t one. So I wrote it.
It is the most-used thing I have ever published: over 34 million downloads, depended on by more than 5,900 repositories on GitHub, MIT licensed, and still maintained more than a decade later — the latest release keeps up with current PHP versions.
There is a lesson in that ratio which I have never forgotten. The platform serving a billion hits a day took a team of fifteen. The library with 34 million downloads took a weekend and answers one question completely. Both are engineering; only one of them scales by being small.
A companion one-time-password library existed alongside it for years. I retired it deliberately once better-maintained alternatives appeared — keeping something alive that someone else now does better is not a service to anyone.