105 lines of PHP that sets up an RFC6238 Time-Based One-Time Password (compatible with Google Authenticator) and uses Ajax to demonstrate validation.