HOTP and TOTP

OTP Auth

Generate and verify one-time passwords with a small, typed Python API.

OTP Auth implements the HOTP and TOTP standards without pulling in a broader authentication framework. Use it for counter-based tokens, authenticator-app codes, and provisioning URIs while keeping the secret and verification flow under your control.

Read the docs View source PyPI

pip install otpauth

What it covers

A focused surface for HOTP and TOTP.

A focused package for generating and verifying HMAC-based and time-based one-time passwords.

01

Time-based passwords

Generate and verify RFC 6238 TOTP codes with configurable periods, digits, and supported hash algorithms.

02

Counter-based passwords

Implement RFC 4226 HOTP flows with explicit counters and constant-time code verification.

03

Authenticator provisioning

Work with Base32 secrets and create otpauth provisioning URIs understood by common authenticator applications.

Coverage

RFC 4226RFC 6238HOTPTOTPSHA-1SHA-256SHA-512Provisioning URIsType hints

Quickstart

Start with the smallest useful example.

Install otpauth, try this focused path, then move into the project documentation for configuration, security notes, and production guidance.

Continue in the docs

Generate and verify a TOTP code

import otpauth

totp = otpauth.TOTP(b"user-secret")

code = totp.generate()
print(totp.string_code(code))

assert totp.verify(code)

Project family

Explore the related libraries.

Sustainability

Support continued maintenance.

Sponsorship supports protocol review, releases, compatibility, documentation, and the maintainer time behind the project family.

View sponsorship options