yeojz/otplib
One Time Password (OTP) / 2FA for Node.js and Browser - Supports HOTP, TOTP and Google Authenticator observed · 2026-08-28
Health v2 · maintenance only
99/100
- Activity 99
- Release rhythm 98
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 10
- age_days: 4525
- days_rel: 12
- days_push: 10
- n_releases_24m: 10
Adoption not part of the score
2289 stars · 146 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
otplib is a TypeScript-first library for generating and verifying one-time passwords (HOTP and TOTP) for two-factor authentication, compatible with Google Authenticator and similar apps. It supports multiple runtimes (Node.js, Bun, Deno, browsers) through a pluggable architecture for crypto and Base32 implementations.
Use cases
- add TOTP two-factor authentication to a Node.js web app
- generate and verify HOTP tokens for hardware tokens
- generate otpauth:// URIs and QR codes for authenticator apps
- implement 2FA login compatible with Google Authenticator and Authy
- generate one-time passwords in the browser or edge runtime
- verify TOTP tokens server-side with counter resync windows
- build a custom OTP flow with pluggable crypto providers
When to choose
- you need RFC-compliant HOTP/TOTP generation and verification in JavaScript or TypeScript
- you need one library that works across Node.js, Bun, Deno, and browsers
- you want audited cryptographic defaults (@noble/hashes, @scure/base) with a plugin system to swap implementations
- you need Google Authenticator-compatible otpauth URIs and QR code setup flows
- you want a TypeScript-first API with full type definitions and async-first design
When to avoid
- you need SMS or email-based OTP delivery rather than authenticator-app tokens
- you need a full identity/auth solution with sessions, users, and password management rather than just OTP primitives
- you are on a non-JavaScript stack (Python, Go, etc.)
- you depend on otplib v12's separate authenticator package or legacy crypto adapters, since v13 is a breaking rewrite
Facets
library · maturity active
auth cryptography security sdk security web-development developer-tools backend frontend browser bun cross-platform otp totp hotp two-factor-authentication 2fa mfa google-authenticator authenticator-apps rfc-4226 rfc-6238 base32 hmac qr-code-uri plugin-architecture web-crypto nodejs deno typescript
4 sources
- readme: https://github.com/yeojz/otplib · fetched 2026-08-28 · 5c2178c3181c
- homepage: https://otplib.yeojz.dev · fetched 2026-08-29 · a01487850b0c
- site_page: https://otplib.yeojz.dev/guide/getting-started.html · fetched 2026-08-29 · e7199165cffd
- registry_npm: https://registry.npmjs.org/otplib · fetched 2026-08-29 · 35098f30a74b
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| yeojz/otplib | main | 99 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem