PYOTP(1) PyOTP PYOTP(1) (NAME) pyotp - PyOTP (OTP) . (2FA) (MFA) . MFA RFC 4226 ( - HOTP) RFC 6238 ( - TOTP) . PyOTP . (HOTP) TOTP Google Authenticator Authy . QR otpauth:// PyOTP . HOTP TOTP RFC . : o HTTPS o HOTP/TOTP o (Replay Attacks) ( OTP OTP ) o ( ) ( RFC 4226 7.3 ) o FIDO U2F WebAuthn HOTP/TOTP . U2F MFA . U2F . U2F Relying Party ( ) . FIDO U2F/WebAuthn PyOTP PyWARP . : OWASP Authentication Cheat Sheet NIST SP 800-63-3: Digital Authentication Guideline (QUICK OVERVIEW OF USING ONE TIME PASSWORDS ON YOUR PHONE) o o o ( ) o Google Authenticator OTP OTP QR Code (INSTALLATION) pip install pyotp (USAGE) (Time-based OTPs) import pyotp import time totp = pyotp.TOTP('base32secret3232') totp.now() # => '492039' # OTP verified for current time totp.verify('492039') # => True time.sleep(30) totp.verify('492039') # => False (Counter-based OTPs) import pyotp hotp = pyotp.HOTP('base32secret3232') hotp.at(0) # => '260182' hotp.at(1) # => '055283' hotp.at(1401) # => '316439' # OTP verified with a counter hotp.verify('316439', 1401) # => True hotp.verify('316439', 1402) # => False (Generating a Secret Key) base32 Google Authenticator OTP : pyotp.random_base32() : pyotp.random_hex() # returns a 40-character hex-encoded secret Google Authenticator (Google Authenticator Compatible) PyOTP Google Authenticator iPhone Android OTP Authy . PyOTP URI QR Code MFA : pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App') >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App' pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name="alice@google.com", issuer_name="Secure App", initial_count=0) >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0' QR Code ( ) OTP . : pyotp.parse_uri('otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App') >>> pyotp.parse_uri('otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0' >>> (Working example) OTP ( Google Authenticator) : [image] : import pyotp totp = pyotp.TOTP("JBSWY3DPEHPK3PXP") print("Current OTP:", totp.now()) (Third-party contributions) : o pyotp.contrib.Steam(): TOTP Steam. pyotp.TOTP() . (Links) o (GitHub) o o (PyPI) o o RFC 4226: HOTP: An HMAC-Based One-Time Password o RFC 6238: TOTP: Time-Based One-Time Password Algorithm o ROTP - Ruby OTP Mark Percival o OTPHP - PHP ROTP Le Lag o OWASP Authentication Cheat Sheet o NIST SP 800-63-3: Digital Authentication Guideline : o WebAuthn o PyWARP (Versioning) Semantic Versioning 2.0.0 . (pin) pip-tools . . [image] [image] [image] [image] [image] .INDENT 0.0 pyotp.parse_uri(uri: str ) -> OTP URI OTP TOTP HOTP . : : uri -- hotp/totp URI : OTP class pyotp.totp.TOTP(s: str , digits: int = 6, digest: Any = None, name: str | None = None, issuer: str | None = None, interval: int = 30) OTP . at(for_time: int | datetime , counter_offset: int = 0) -> str datetime . ( OTP ) : totp = pyotp.TOTP(...) time_remaining = totp.interval - datetime.datetime.now().timestamp() % totp.interval : o for_time -- OTP o counter_offset -- : OTP now() -> str OTP : OTP provisioning_uri(name: str | None = None, issuer_name: str | None = None, **kwargs) -> str URI OTP . QR Code OTP Google Authenticator . : timecode(for_time: datetime ) -> int datetime (for_time.tzinfo is None) (timecode) . verify(otp: str , for_time: datetime | None = None, valid_window: int = 0) -> bool OTP OTP . : o otp -- OTP o for_time -- OTP ( ) o valid_window -- : True False class pyotp.hotp.HOTP(s: str , digits: int = 6, digest: Any = None, name: str | None = None, issuer: str | None = None, initial_count: int = 0) OTP HMAC. at(count: int ) -> str OTP . : count -- HMAC OTP : OTP provisioning_uri(name: str | None = None, initial_count: int | None = None, issuer_name: str | None = None, **kwargs) -> str URI OTP . QR Code OTP Google Authenticator . : : o name -- o initial_count -- HMAC 0 o issuer_name -- OTP Authenticator : provisioning URI verify(otp: str , counter: int ) -> bool OTP OTP . : o otp -- OTP o counter -- HMAC OTP pyotp.utils.build_uri(secret: str , name: str , initial_count: int | None = None, issuer: str | None = None, algorithm: str | None = None, digits: int | None = None, period: int | None = None, **kwargs) -> str URI OTP TOTP HOTP . QR Code Google Authenticator . . : : o secret -- hotp/totp URI o name -- o initial_count -- None . None OTP TOTP . o issuer -- OTP Authenticator o algorithm -- OTP. o digits -- OTP. o period -- OTP . o kwargs -- query string URI : provisioning uri pyotp.utils.strings_equal(s1: str , s2: str ) -> bool (Timing attacks). == (short-circuit). . class pyotp.contrib.steam.Steam(s: str , name: str | None = None, issuer: str | None = None, interval: int = 30, digits: int = 5) TOTP Steam. pyotp.totp.TOTP. generate_otp(input: int ) -> str : input -- HMAC OTP. (RELEASE NOTES) 2.10.0 (CHANGES FOR V2.10.0 - 2026-06-13) o / parse_uri (#187) o generate_otp() Steam (#179) o OTP (#170) o otpauth o (#162) 2.9.0 (CHANGES FOR V2.9.0 - 2023-07-27) o Steam TOTP parse_uri() (#153) o 2.8.0 (CHANGES FOR V2.8.0 - 2022-12-13) o OTP (constant time) (#148) o o 3.6 3.11 2.7.0 (CHANGES FOR V2.7.0 - 2022-09-11) o Steam TOTP (#142) o 2.6.0 (CHANGES FOR V2.6.0 - 2021-02-04) o base32 ( RFC) (#115). o provisioning_uri verify() (#115). 2.5.1 (CHANGES FOR V2.5.1 - 2021-01-29) o parse_uri (#114) 2.5.0 (CHANGES FOR V2.5.0 - 2021-01-29) o provisioning_uri (#113) o `parse_uri' (#111) o base32 2.4.1 (CHANGES FOR V2.4.1 - 2020-10-16) o parse_uri: (#108) o datetime TOTP.timecode() (#107) 2.4.0 (CHANGES FOR V2.4.0 - 2020-07-29) o at(for_time) (#85) o provisioning URI (#84) o ( ) o random_hex (#82) 2.3.0 (CHANGES FOR V2.3.0 - 2019-07-26) o 2.7 2.2.8 (CHANGES FOR V2.2.8 - 2019-07-26) o (#78) o 2.2.7 (CHANGES FOR V2.2.7 - 2018-11-05) o random_base32() `secrets' (#66) o : o setup.py 2.2.6 (CHANGES FOR V2.2.6 - 2017-06-10) o provisioning URI 2.2.5 (CHANGES FOR V2.2.5 - 2017-06-03) o query string provisioning_uri. #47. o at() (#41). o . 2.2.4 (CHANGES FOR V2.2.4 - 2017-01-04) o 2.6 ( 2.6 ) o o 2.2.3 (CHANGES FOR V2.2.3 - 2017-01-04) o 2.6 ( 2.6 ) o o 2.2.2 (CHANGES FOR V2.2.2 - 2017-01-04) o 2.6 ( 2.6 ) o 2.2.1 (CHANGES FOR V2.2.1 - 2016-08-30) o python-future (#34) o (#30) o : . Eeo Jun (#28). o algorithm digits period provisioning_uri. Dionisio E Alonso (#33). o . 2.2.0 (CHANGES FOR V2.2.0 - 2016-08-30) o 2.2.1 2.1.0 (Version 2.1.0 - 2016-05-02) o TOTP.verify. Zeev Rotshtein (PR #19). o . Kun Yan (#20). o . 2.0.1 (Version 2.0.1 - 2015-09-28) o 2.0.0 easy_install . 2.0.0 (Version 2.0.0 - 2015-08-22) o pyotp.HOTP.at() pyotp.TOTP.at() pyotp.TOTP.now() . Rohan Dhaimade (PR #16). 1.4.2 (Version 1.4.2 - 2015-07-21) o . o . o Travis CI. 1.3.1 (Version 1.3.1 - 2012-02-29) o . (AUTHOR) PyOTP (COPYRIGHT) PyOTP June 16, 2026 PYOTP(1)