TypeScript-first library for HOTP and TOTP / Authenticator with multi-runtime (Node, Bun, Deno, Browser) support via plugins.
A web based demo is available at https://otplib.yeojz.dev.
[!IMPORTANT]
v13 is a complete rewrite with breaking changes:
- New
- Security-audited plugins — Default crypto uses
@noble/hashesand@scure/base, both independently audited- Cross-platform defaults — Works out-of-the-box in Node.js, Bun, Deno, and browsers
- Full type safety — Comprehensive TypeScript types with strict mode from the ground up
- Async-first API — All operations are async by default; sync variants available for compatible plugins
- Removed
- Separate authenticator package — TOTP now covers all authenticator functionality
- Outdated plugins — Legacy crypto adapters removed in favor of modern, audited alternatives
See Migration Guide for details.
# Node
npm install otplib
pnpm add otplib
yarn add otplib
# Other runtimes
bun add otplib
deno install npm:otplib
import { generateSecret, generate, verify, generateURI } from "otplib";
// Generate a secret
const secret = generateSecret();
// Generate a TOTP token
const token = await generate({ secret });
// Verify a token
const isValid = await verify({ secret, token });
// Generate QR code URI for authenticator apps
const uri = generateURI({
issuer: "MyService",
label: "user@example.com",
secret,
});
import { OTP } from "otplib";
// Create OTP instance (defaults to TOTP)
const otp = new OTP();
// Generate a secret
const secret = otp.generateSecret();
// Generate a TOTP token
const token = await otp.generate({ secret });
// Verify a token
const isValid = await otp.verify({ secret, token });
// Generate QR code URI for authenticator apps
const uri = otp.generateURI({
issuer: "MyService",
label: "user@example.com",
secret,
});
By default, otplib expects secrets to be in Base32 format. While the core HOTP (RFC 4226) and TOTP (RFC 6238) specifications work with raw binary data and don't mandate Base32 encoding, Base32 is the standard format used by authenticator applications and QR code URIs for compatibility.
// Base32 secret (standard format for authenticator compatibility)
const secret = "GEZDGNBVGY3TQOJQGEZDGNBVGY";
However, if you need to use secrets in other formats, you can either use the plugin-base32-alt plugin for raw strings or pass a byte array (using stringToBytes helper) for binary data.
For more details and examples, see the Secret Handling Guide and related plugin documentation in the guides directory.
Refer to the Getting Started Guide, or check out the other sections in the guide:
MIT © 2026 Gerald Yeo
Speakeasy is another popular library for generating and validating one-time passwords (OTPs) using TOTP and HOTP algorithms. It offers similar functionalities to otplib but with a slightly different API. Speakeasy is known for its simplicity and ease of use.
Notp is a minimalistic library for generating and validating TOTP and HOTP tokens. It provides basic functionalities similar to otplib but lacks some of the advanced configuration options and features available in otplib.
FAQs
TypeScript-first library for TOTP and HOTP with multi-runtime and plugin support
The npm package otplib receives a total of 2,262,607 weekly downloads. As such, otplib popularity was classified as popular.
We found that otplib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.
Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.