gen-totpOne-time passwords. Simple, typed APIs.

Generate and verify TOTP and HOTP in Node.js. Set up authenticators with secure random secrets and a small, focused API.

Get started

Explore the API

Time-based passwords

Generate fixed-width codes with a 30-second default period and verify a configurable clock-drift window.

Counter-based passwords

Generate HOTP codes and receive the next counter after verification, ready to persist in your application.

Authenticator setup

Create cryptographically random Base32 secrets and otpauth URIs for QR-code enrollment.

Explicit encodings

Choose UTF-8, hexadecimal, or Base32. Validation catches malformed secrets and invalid configuration.

Tested against RFC vectors

The test suite covers all RFC 4226 HOTP and RFC 6238 SHA-1, SHA-256, and SHA-512 reference vectors.

Ready for Node.js

CommonJS and native ESM entry points, TypeScript declarations, and installed-package smoke checks.

From secret to code

import genTOTP, { generateSecretKey, verifyTOTP } from 'gen-totp';

const secret = generateSecretKey();
const options = { encoding: 'base32' as const };
const token = genTOTP(secret, options);
const valid = verifyTOTP(secret, token, options);

Start with authenticator setup to enroll a user, or open the API reference for every function and option.