@prsm/otp

A simple and secure library for generating and verifying One-Time Passwords (OTPs) based on the TOTP algorithm.

Installation

1npm install @prsm/otp

Usage

Create a Secret

Generate a secret with different strengths:

1import Otp from "@prsm/otp";
2
3// Default (high) strength
4const secret = Otp.createSecret();
5
6// Low strength
7const lowStrengthSecret = Otp.createSecret(Otp.SHARED_SECRET_STRENGTH_LOW);
8
9// Moderate strength
10const moderateStrengthSecret = Otp.createSecret(Otp.SHARED_SECRET_STRENGTH_MODERATE);

For each user, store the secret securely and associate it with the user. When authenticating a user, you need to reference the secret that was generated for that user. The secret should be kept confidential and never shared.

Generate a TOTP

1const secret = Otp.createSecret();
2const totp = Otp.generateTotp(secret);
3console.log(totp); // A 6-digit TOTP
4
5const totp8 = Otp.generateTotp(secret, undefined, 8);
6console.log(totp8); // An 8-digit TOTP

Verify a TOTP

1const isValid = Otp.verifyTotp(secret, totp);
2console.log(isValid); // true, even if the TOTP is expired

For strict verification, you can specify the number of steps and the time window:

1const isValidStrict = Otp.verifyTotp(secret, totp, 0, 0);
2console.log(isValidStrict); // true only if the TOTP is valid at the current time

Generate a TOTP URI for QR Code

1const uri = Otp.createTotpKeyUriForQrCode("app.example.com", "john.doe@example.org", secret);
2console.log(uri); // URI for QR code

Custom Configuration

Customize OTP length, interval, and hash function:

1const customTotp = Otp.generateTotp(secret, undefined, 8, 60, undefined, Otp.HASH_FUNCTION_SHA_256);
2const isValidCustom = Otp.verifyTotp(secret, customTotp, undefined, undefined, undefined, 8, 60, undefined, Otp.HASH_FUNCTION_SHA_256);
3console.log(isValidCustom); // true

Error Handling

Handle specific errors:

1try {
2  Otp.generateTotp("shortsecret");
3} catch (error) {
4  if (error instanceof Otp.InvalidSecretError) {
5    console.error("The provided secret is too short.");
6  }
7}