larztotp

TOTP/HOTP two-factor auth codes. Pure Python (stdlib), zero dependencies.

Generate and verify the 6-digit one-time passwords authenticator apps use (Google Authenticator, Authy, 1Password), plus the provisioning otpauth:// URI for the setup QR — all from the standard library, matching the RFC test vectors so codes interoperate with every app.

from larztotp import TOTP

totp = TOTP.generate()                                   # new random secret
uri = totp.provisioning_uri("alice@example.com", issuer="MyApp")   # QR this
totp.verify(user_entered_code)                           # True / False

Why

• Standards-correct. HOTP (RFC 4226) and TOTP (RFC 6238), tested against the published RFC vectors — the codes match real authenticator apps exactly.
• Skew-tolerant, safe verify. A configurable time window accepts a slightly off clock; comparison is constant-time.
• Zero dependencies. Pure hmac/hashlib/base64 — no pyotp, nothing to install. A natural companion to larzcrypt.

Install

pip install larztotp

Usage

from larztotp import TOTP, hotp, totp, verify, generate_secret

t = TOTP.generate(); t.now(); t.verify(code, window=1)
t.provisioning_uri("bob@x.com", issuer="App")

# or the raw functions
secret = generate_secret()
hotp(secret, counter=0)
totp(secret)                       # current 6-digit code
verify(secret, code, window=1)

SHA256/SHA512 and 8-digit codes are supported via algorithm=/digits=.

Tests

python -m unittest discover -s tests -v   # 15 tests incl. RFC 4226/6238 vectors

The Larz stack

One of 30+ pure-Python, zero-dependency libraries at github.com/larz-scripter — see larzcrypt and larzid.

License

MIT © larz-scripter