DOCSEARCHbyAlgolia
Submit Docs

PyOTP Documentation

repository·main·Indexed 25 days ago

https://github.com/pyauth/pyotp

A Python library for generating and verifying one-time passwords (OTP) following RFC 4226 (HOTP) and RFC 6238 (TOTP) standards. It provides tools for implementing two-factor (2FA) and multi-factor (MFA) authentication, including support for provisioning URIs for QR codes, secure secret generation via random_base32 and random_hex, and a specialized third-party implementation for Steam TOTP.

Tokens
1.7K
Snippets
3
Records
23
Agent score
85%

What's inside PyOTP

  2. Use Time-based OTPs (TOTP)

    main

    Implement TOTP (RFC 6238) using the pyotp.TOTP class. You can generate the current code using .now() and verify a provided code using .verify(code). Note that TOTP codes are time-sensitive.

    import pyotp
import time

totp = pyotp.TOTP('base32secret3232')
totp.now() # => '492039'

# OTP verified for current time
totp.verify('492039') # => True
time.sleep(30)
totp.verify('492039') # => False

  3. Use Counter-based OTPs (HOTP)

    main

    Implement HOTP (RFC 4226) using the pyotp.HOTP class. You can generate a code for a specific counter index using .at(counter) and verify a code against a specific counter using .verify(code, counter).

    import pyotp

hotp = pyotp.HOTP('base32secret3232')
hotp.at(0) # => '260182'
hotp.at(1) # => '055283'
hotp.at(1401) # => '316439'

# OTP verified with a counter
hotp.verify('316439', 1401) # => True
hotp.verify('316439', 1402) # => False

  4. Generate random secret keys

    main

    PyOTP provides helper functions to generate secure secrets:

    • pyotp.random_base32(): Generates a 32-character base32 secret (compatible with Google Authenticator).
    • pyotp.random_hex(): Generates a 40-character hex-encoded secret.

  5. Generate provisioning URIs for QR Codes

    main

    To allow users to easily add credentials to apps like Google Authenticator or Authy, generate a provisioning URI using the .provisioning_uri() method. This URI can then be converted into a QR code.

    For TOTP: pyotp.totp.TOTP(secret).provisioning_uri(name='user@email.com', issuer_name='App Name')

    For HOTP: pyotp.hotp.HOTP(secret).provisioning_uri(name='user@email.com', issuer_name='App Name', initial_count=0)

  9. Generate a random Base32 secret

    main
    Use random_base32 to generate a random Base32 encoded string for use as an OTP secret. Note that the otpauth scheme does not use Base32 padding for secret lengths not divisible by 8, which may cause issues with some third-party tools. The length must be at least 32 characters to ensure the secret is at least 160 bits.

  10. Initialize the TOTP class

    main
    Create a TOTP instance by providing a base32 encoded secret. You can customize the number of digits, the HMAC digest function (defaults to hashlib.sha1), the account name, the issuer, and the time interval in seconds.

  11. Verify a TOTP code

    main
    Verify a provided OTP string using verify(). You can specify a for_time and a valid_window. The valid_window extends validity to a specific number of counter ticks before and after the current one to account for clock drift.

  12. Use Steam-specific TOTP with the Steam class

    main

    The Steam class provides a specialized implementation of Time-based One-Time Password (TOTP) specifically for Steam accounts. It uses Steam's custom alphabet (23456789BCDFGHJKMNPQRTVWXY) and defaults to a 5-digit code length.

    To use it, instantiate the Steam class with your base32 secret. You can optionally provide a name, issuer, or a custom interval (defaulting to 30 seconds).