# totp-generator

> Generate TOTP tokens from key

Latest version **2.0.1** (published 2026-01-07) · MIT license · 0 weekly downloads

## Install

```sh
npm install totp-generator
pnpm add totp-generator
yarn add totp-generator
bun add totp-generator
```

## Health

**Score 60/100 (C)** — status: stable.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 2.0.1 |
| Published | 2026-01-07 |
| First published | 2016-06-07 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 1 |
| Unpacked size | 23.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 314 |
| Author | Magnus Bellstrand |
| Maintainers | bellstrand |
| Keywords | totp, time-based one-time password, generator, password, auth, authentication, google authenticator, oath, 2-factor, two-factor |

## Links

- npm: https://www.npmjs.com/package/totp-generator
- Repository: https://github.com/bellstrand/totp-generator
- Issues: https://github.com/bellstrand/totp-generator/issues
- npm.io page: https://npm.io/package/totp-generator

## Dependencies (1)

- [jssha](https://npm.io/package/jssha.md) ^3.3.1

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 2.0.1 (latest) — 2026-01-07
- 1.0.0-beta-3 (beta) — 2024-01-29
- 2.0.0 — 2025-09-10
- 1.1.0 — 2025-09-08
- 1.0.0 — 2024-02-01
- 1.0.0-beta-2 — 2024-01-29
- 1.0.0-beta-1 — 2024-01-29
- 1.0.0-beta-0 — 2024-01-29
- 0.0.14 — 2022-10-13
- 0.0.13 — 2021-11-24
- 0.0.12 — 2021-10-15
- 0.0.11 — 2021-10-15
- 0.0.10 — 2021-10-01
- 0.0.9 — 2021-03-22
- 0.0.8 — 2020-10-31
- … 7 more at https://npm.io/package/totp-generator/versions

## README

# totp-generator

[![Test](https://github.com/bellstrand/totp-generator/workflows/Test/badge.svg)](https://github.com/bellstrand/totp-generator/actions?query=workflow%3ATest)
[![npm Version](https://img.shields.io/npm/v/totp-generator.svg)](https://www.npmjs.com/package/totp-generator)

totp-generator lets you generate TOTP tokens from a TOTP key

## How to use

```javascript
import { TOTP } from "totp-generator"

// Keys provided must be base32 strings, ie. only containing characters matching (A-Z, 2-7, =).
const { otp, expires } = await TOTP.generate("JBSWY3DPEHPK3PXP")

console.log(otp) // prints a 6-digit time-based token based on provided key and current time
```

## Default token settings

- SHA-1
- 30-second epoch interval
- 6-digit tokens

## Custom token settings

Settings can be provided as an optional second parameter:

```javascript
import { TOTP } from "totp-generator"

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", { digits: 8 })
console.log(otp) // prints an 8-digit token

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", { digits: 8, explicitZeroPad: true })
console.log(otp) // prints an 8-digit token (with explicit zero padding to always be 8 digits long)

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", { algorithm: "SHA-512" })
console.log(otp) // prints a token created using a different algorithm

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", { period: 60 })
console.log(otp) // prints a token using a 60-second epoch interval

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", { timestamp: 1465324707000 })
console.log(otp) // prints a token for given time

const { otp } = await TOTP.generate("JBSWY3DPEHPK3PXP", {
	digits: 8,
	algorithm: "SHA-512",
	period: 60,
	timestamp: 1465324707000,
})
console.log(otp) // prints a token using all custom settings combined
```

## What do I use this library for?

- TOTP generation
- E2E tests (where you need to login with 2-factor authentication)

## 💥 Breaking Changes in v2.0.0
The generate() method has been refactored to be asynchronous. This was done by replacing the external jssha library with the native Web Crypto API, which is more secure and performant.

| Before (v1.x.x)                   | After (v2.0.0)                          |
| --------------------------------- | --------------------------------------- |
| `const token = generate(secret);` | `const token = await generate(secret);` |

---
_Source: https://npm.io/package/totp-generator · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._