A versatile One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun, and browsers enabling secure multi-factor authentication implementations.
One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.
This library is used to generate and validate HMAC-Based One-Time Passwords (HOTP) and Time-Based One-Time Passwords (TOTP) for multi-factor authentication (MFA) or two-factor authentication (2FA) systems. Developers building authentication systems or enhancing password security in web or server applications would use this tool to integrate secure OTP mechanisms.
It is recommended to use default values for algorithm, digits, and period unless specific requirements exist, as these defaults align with most services. Always use secrets with at least 128 bits of entropy (16 bytes) to ensure security. Implement throttling on the server side to mitigate brute force attacks, and keep the token validation window as small as possible to reduce risk. Refer to RFC 4226 Section 7 and RFC 6238 Section 5 for detailed security considerations.
Install via npm: npm install otpauth
Import the library in your project: import * as OTPAuth from "otpauth"
Use the library in Node.js, Deno, Bun, or browser environmentsimport * as OTPAuth from "otpauth";
Imports the OTPAuth library for use in your application.
let totp = new OTPAuth.TOTP({ issuer: "ACME", label: "Alice", algorithm: "SHA1", digits: 6, period: 30, secret: "US3WHSG7X5KAPV27VANWKQHF3SH3HULL" });
Creates a new TOTP object configured with issuer, label, algorithm, digits, period, and secret.
let secret = new OTPAuth.Secret({ size: 20 });
Generates a cryptographically secure random secret of 20 bytes.
let token = totp.generate();
Generates the current OTP token as a string.
let delta = totp.validate({ token, window: 1 });
Validates a given token within a time window to account for clock drift, returning the token delta or null if invalid.
let counter = totp.counter();
Retrieves the current counter value representing the number of intervals since the Unix epoch.
let remaining = totp.remaining();
Returns the remaining milliseconds until the current token expires.
let uri = totp.toString();
Converts the TOTP configuration to a Google Authenticator-compatible key URI format.
const OTPAuth = await import("otpauth");
Loads the OTPAuth library dynamically in a browser console environment.