Quantum key distribution (QKD) promises provably secure communications. In order to improve the secret key rate, combining a biased basis choice with the decoy-state method is proposed. Concomitantly, there is a basis-independent detection efficiency condition, which usually cannot be satisfied in a practical system, such as the time-phase encoding. Fortunately, this flaw has been recently removed theoretically and experimentally in the four-intensity decoy-state BB84 QKD protocol using the fact that the expected yields of single-photon states prepared in two bases stay the same for a given measurement basis. However, the security proofs do not fully consider the finite-key effects for general attacks. In this work, we provide the rigorous finite-key security bounds in the universally composable framework for the four-intensity decoy-state BB84 QKD protocol. We build a time-phase encoding system with 200 MHz clock to implement this protocol, in which the real-time secret key rate is more than 60 kbps over 50 km single-mode fiber.