# hectorm/otpauth

One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.

Repository: https://github.com/hectorm/otpauth
Canonical: https://ross.abutalabs.com/products/otpauth
Homepage: https://hectorm.github.io/otpauth/
Language: JavaScript
License: MIT
License Family: permissive
Topics: otpauth, hotp, totp, otp, two-factor, two-factor-authentication, authenticator, google-authenticator, auth, javascript, nodejs, node, browser, security, deno, bun
Last push: 2026-07-25T14:08:21+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 69, longevity 100
- inputs: {"age_days": 3529, "days_push": 39, "days_rel": 130, "gap_med": 79, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1471, forks 82 (observed 2026-08-28T04:04:49.288863+00:00)

## What it is
A JavaScript One-Time Password library implementing HOTP (RFC 4226) and TOTP (RFC 6238) for generating and validating 2FA tokens. It runs in Node.js, Deno, Bun, and browsers, and supports secret generation, token validation, and otpauth:// URI handling.

## Use cases
- add TOTP two-factor authentication to a web app
- generate and validate HOTP/TOTP tokens in Node.js
- implement 2FA compatible with Google Authenticator
- generate otpauth:// URIs for authenticator apps
- generate cryptographically secure OTP secrets in the browser

## When to choose
- you need a dependency-light, cross-runtime (Node/Deno/Bun/browser) OTP library
- you need standards-compliant HOTP/TOTP with RFC 4226/6238 support
- you want to interoperate with Google Authenticator and similar apps

## When to avoid
- you need full MFA infrastructure with SMS or push-based factors
- you need a server-side identity platform with user management, not just OTP generation
- your stack is not JavaScript-based

## Facets
- artifact type: library
- maturity: stable
- function: auth, cryptography, security
- domain: security, web-development, developer-tools
- platform: bun, browser, cross-platform
- tags: otp, hotp, totp, two-factor-authentication, 2fa, google-authenticator, rfc-4226, rfc-6238, mfa, nodejs, deno, javascript

## Member repositories
- hectorm/otpauth (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:49.288863+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:34:46.344248+00:00, confidence not recorded.
  - readme: https://github.com/hectorm/otpauth (fetched 2026-08-28T04:04:49.288863+00:00, sha 25c495478e87)
  - homepage: https://hectorm.github.io/otpauth/ (fetched 2026-08-29T11:42:53.011640+00:00, sha a375b3022e7e)
  - registry_npm: https://registry.npmjs.org/otpauth (fetched 2026-08-29T11:42:53.020555+00:00, sha ccac0cbf4a99)
- Data as of 2026-08-30T08:39:29.467469+00:00.