@otplib/hotp

@otplib/hotp

RFC 4226 HOTP implementation for otplib.

Installation

npm install @otplib/hotp
pnpm install @otplib/hotp
yarn add @otplib/hotp

Usage

import { generate, verify } from "@otplib/hotp";
import { NodeCryptoPlugin } from "@otplib/plugin-crypto-node";
import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";

const crypto = new NodeCryptoPlugin();
const base32 = new ScureBase32Plugin();

// Generate an HOTP token for counter 0
const token = await generate({
  secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
  counter: 0,
  crypto,
  base32,
});

// Verify an HOTP token
const result = await verify({
  secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
  token: "123456",
  counter: 0,
  crypto,
  base32,
  counterTolerance: 0,
});

// result.valid: boolean
// result.delta: number | null

Functions

generate

Generate an HOTP code for a specific counter:

import { generate } from '@otplib/hotp';

const token = await generate({
  secret: new Uint8Array([...]),  // Required: secret as bytes
  counter: 0,                      // Required: counter value
  crypto: new NodeCryptoPlugin(),  // Required: crypto plugin
  base32: new ScureBase32Plugin(), // Optional: base32 plugin (for decoding)
  algorithm: 'sha1',               // Optional: 'sha1' | 'sha256' | 'sha512'
  digits: 6,                       // Optional: 6 | 7 | 8
});

verify

Verify an HOTP code:

import { verify } from '@otplib/hotp';

const result = await verify({
  secret: new Uint8Array([...]),  // Required: secret as bytes
  token: '123456',                 // Required: token to verify
  counter: 0,                      // Required: expected counter
  crypto: new NodeCryptoPlugin(),  // Required: crypto plugin
  base32: new ScureBase32Plugin(), // Optional: base32 plugin (for decoding)
  algorithm: 'sha1',               // Optional: hash algorithm
  digits: 6,                       // Optional: expected digits
  counterTolerance: 5,             // Optional: look-ahead tolerance
});

// Returns: { valid: boolean, delta: number | null }

Documentation

Full documentation available at otplib.yeojz.dev:

• Getting Started Guide
• API Reference

License

MIT © 2026 Gerald Yeo

Similar packages

Other packages similar to @otplib/hotp

speakeasy

Speakeasy is a popular library for generating and verifying one-time passwords, including both HOTP and TOTP. It offers similar functionality to @otplib/hotp but also includes additional features like QR code generation for easier integration with mobile authenticator apps.

notp

notp is a simple library for generating and verifying both HOTP and TOTP tokens. It is lightweight and easy to use, similar to @otplib/hotp, but may not have as many configuration options or additional features as otplib.