Metadata-Version: 2.4
Name: larztotp
Version: 0.1.0
Summary: TOTP/HOTP two-factor auth codes (RFC 6238/4226) with provisioning URIs. Pure Python stdlib, zero dependencies.
Author: larz-scripter
License: MIT
Project-URL: Homepage, https://github.com/larz-scripter/larztotp
Project-URL: Repository, https://github.com/larz-scripter/larztotp
Project-URL: Issues, https://github.com/larz-scripter/larztotp/issues
Keywords: totp,hotp,2fa,two-factor-authentication,otp,authenticator,rfc6238,rfc4226,mfa,security,zero-dependency
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# larztotp

**TOTP/HOTP two-factor auth codes. Pure Python (stdlib), zero dependencies.**

Generate and verify the 6-digit one-time passwords authenticator apps use (Google
Authenticator, Authy, 1Password), plus the provisioning `otpauth://` URI for the
setup QR — all from the standard library, matching the RFC test vectors so codes
interoperate with every app.

```python
from larztotp import TOTP

totp = TOTP.generate()                                   # new random secret
uri = totp.provisioning_uri("alice@example.com", issuer="MyApp")   # QR this
totp.verify(user_entered_code)                           # True / False
```

## Why

- **Standards-correct.** HOTP (RFC 4226) and TOTP (RFC 6238), tested against the
  published RFC vectors — the codes match real authenticator apps exactly.
- **Skew-tolerant, safe verify.** A configurable time `window` accepts a slightly
  off clock; comparison is constant-time.
- **Zero dependencies.** Pure `hmac`/`hashlib`/`base64` — no `pyotp`, nothing to
  install. A natural companion to
  [larzcrypt](https://github.com/larz-scripter/larzcrypt).

## Install

```bash
pip install larztotp
```

## Usage

```python
from larztotp import TOTP, hotp, totp, verify, generate_secret

t = TOTP.generate(); t.now(); t.verify(code, window=1)
t.provisioning_uri("bob@x.com", issuer="App")

# or the raw functions
secret = generate_secret()
hotp(secret, counter=0)
totp(secret)                       # current 6-digit code
verify(secret, code, window=1)
```

SHA256/SHA512 and 8-digit codes are supported via `algorithm=`/`digits=`.

## Tests

```bash
python -m unittest discover -s tests -v   # 15 tests incl. RFC 4226/6238 vectors
```

## The Larz stack

One of 30+ pure-Python, zero-dependency libraries at
[github.com/larz-scripter](https://github.com/larz-scripter) — see
**[larzcrypt](https://github.com/larz-scripter/larzcrypt)** and
**[larzid](https://github.com/larz-scripter/larzid)**.

## License

MIT © larz-scripter
