otplib

otplib

TypeScript-first library for HOTP and TOTP / Authenticator with multi-runtime and plugin support

Breaking Changes (v13)

[!IMPORTANT]
v13 is a complete rewrite with breaking changes:

• New
  • Security-audited plugins — Default crypto uses @noble/hashes and @scure/base, both independently audited
  • Cross-platform defaults — Works out-of-the-box in Node.js, Bun, Deno, and browsers
  • Full type safety — Comprehensive TypeScript types with strict mode from the ground up
  • Async-first API — All operations are async by default; sync variants available for compatible plugins
• Removed
  • Separate authenticator package — TOTP now covers all authenticator functionality
  • Outdated plugins — Legacy crypto adapters removed in favor of modern, audited alternatives

See Migration Guide for details.

Features

• Zero Configuration - Works out of the box with sensible defaults
• RFC Compliant - RFC 6238 (TOTP) and RFC 4226 (HOTP)
• TypeScript-First - Full type definitions
• Google Authenticator Compatible - Full otpauth:// URI support

Installation

npm install otplib
pnpm add otplib
yarn add otplib

Quick Start

Functional API (Recommended)

import { generateSecret, generate, verify, generateURI } from "otplib";

// Generate a secret
const secret = generateSecret();

// Generate a TOTP token
const token = await generate({ secret });

// Verify a token
const isValid = await verify({ secret, token });

// Generate QR code URI for authenticator apps
const uri = generateURI({
  issuer: "MyService",
  label: "[e-mail]",
  secret,
});

Class API

import { OTP } from "otplib";

// Create OTP instance (defaults to TOTP)
const otp = new OTP();

// Generate a secret
const secret = otp.generateSecret();

// Generate a TOTP token
const token = await otp.generate({ secret });

// Verify a token
const isValid = await otp.verify({ secret, token });

// Generate QR code URI for authenticator apps
const uri = otp.generateURI({
  issuer: "MyService",
  label: "[e-mail]",
  secret,
});

Documentation

Full documentation available at here:

• Getting Started Guide
• Runtime Compatibility
• Security Considerations
• API Reference

License

MIT © 2026 Gerald Yeo

Similar packages

Other packages similar to otplib

speakeasy

Speakeasy is another popular library for generating and validating one-time passwords (OTPs) using TOTP and HOTP algorithms. It offers similar functionalities to otplib but with a slightly different API. Speakeasy is known for its simplicity and ease of use.

notp

Notp is a minimalistic library for generating and validating TOTP and HOTP tokens. It provides basic functionalities similar to otplib but lacks some of the advanced configuration options and features available in otplib.