Skip to content
A free software implementation of Symantec's VIP Access application and protocol
Python Dockerfile
Branch: master
Clone or download
Pull request Compare This branch is 68 commits ahead, 3 commits behind cyrozap:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
tests add tests for generating and validating HOTP token types (fixes #27) Jun 4, 2019
vipaccess handle provisioned tokens a little more carefully Jun 4, 2019
Dockerfile use requirements.txt in Dockerfile Sep 14, 2018
LICENSE.txt First commit Sep 30, 2014 I'm really bad at building working Python packages 🤦🏻‍♂ Jun 1, 2019 s/otpaath/otpauth Aug 31, 2019
description.rst fix, add description.rst, and call it v0.10.1… so we can upd… Jun 1, 2019
requirements.txt lxml 3.5 is fine (ping #19) May 31, 2019 v0.10.3 Jun 4, 2019


PyPI License: Apache 2.0 Build Status

Table of Contents

This is a fork of cyrozap/python-vipaccess. Main differences:

  • No dependency on qrcode or image libraries; you can easily use external tools such as qrencode to convert an otpauth:// URI to a QR code if needed, so it seems unnecessary to build in this functionality.
  • Option to generate either the desktop (VSST) or mobile (VSMT) version on the VIP Access tokens; as far as I can tell there is no real difference between them, but some clients require one or the other specifically. There are also some rarer token types/prefixes which can be generated if necessary (reference list from Symantec)
  • Command-line utility is expanded to support both token provisioning (creating a new token) and emitting codes for an existing token (inspired by the command-line interface of stoken, which handles the same functions for RSA SecurID tokens


python-vipaccess is a free and open source software (FOSS) implementation of Symantec's VIP Access client.

If you need to access a network which uses VIP Access for two-factor authentication, but can't or don't want to use Symantec's proprietary applications—which are only available for Windows, MacOS, Android, iOS—then this is for you.

As @cyrozap discovered in reverse-engineering the VIP Access protocol (original blog post), Symantec VIP Access actually uses a completely open standard called Time-based One-time Password Algorithm for generating the 6-digit codes that it outputs. The only non-standard part is the provisioning protocol used to create a new token.


For development purposes, you can install the dependencies with pip install -r requirements.txt in the project root directory.

To install pip see the pip installation documentation.


Install with pip3 to automatically fetch Python dependencies. (Note that on most systems, pip3 invokes the Python 3.x version, while pip invokes the Python 2.7 version; Python 2.7 is still supported, but not recommended because it's nearing obsolescence.)

# Install latest release from PyPI
$ pip3 install python-vipaccess

# Install latest development version from GitHub
$ pip3 install


Provisioning a new VIP Access credential

This is used to create a new VIP Access token: by default, it stores the new credential in the file .vipaccess in your home directory (in a format similar to stoken), but it can store to another file instead, or instead just print out the "token secret" string with instructions about how to use it.

usage: vipaccess provision [-h] [-p | -o DOTFILE] [-t TOKEN_MODEL]

optional arguments:
  -h, --help            show this help message and exit
  -p, --print           Print the new credential, but don't save it to a file
  -o DOTFILE, --dotfile DOTFILE
                        File in which to store the new credential (default
  -t TOKEN_MODEL, --token-model TOKEN_MODEL
                        VIP Access token model. Normally VSST (desktop token,
                        default) or VSMT (mobile token). Some clients only
                        accept one or the other. Other more obscure token
                        types also exist:

Here is an example of the output from vipaccess provision -p:

Credential created successfully:
This credential expires on this date: 2019-01-15T12:00:00.000Z

You will need the ID to register this credential: VSST12345678

You can use oathtool to generate the same OTP codes
as would be produced by the official VIP Access apps:

    oathtool    -b --totp AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  # output one code
    oathtool -v -b --totp AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  # ... with extra information

Here is the format of the .vipaccess token file output from vipaccess provision [-o ~/.vipaccess]. (This file is created with read/write permissions only for the current user.)

version 1
id VSST12345678
expiry 2019-01-15T12:00:00.000Z

Display a QR code to register your credential with mobile TOTP apps

Once you generate a token with vipaccess provision, use vipaccess uri to show the otpauth:// URI and qrencode to display that URI as a QR code:

$ qrencode -t UTF8 'otpauth://totp/VIP%20Access:VSSTXXXX?secret=YYYY&issuer=Symantec&algorithm=SHA1&digits=6'

Scan the code into your TOTP generating app, like FreeOTP or Google Authenticator.

Generating access codes using an existing credential

The vipaccess [show] option will also do this for you: by default it generates codes based on the credential in ~/.vipaccess, but you can specify an alternative credential file or specify the OATH "token secret" on the command line.

usage: vipaccess show [-h] [-s SECRET | -f DOTFILE]

optional arguments:
  -h, --help            show this help message and exit
  -s SECRET, --secret SECRET
                        Specify the token secret on the command line (base32
  -f DOTFILE, --dotfile DOTFILE
                        File in which the credential is stored (default

As alluded to above, you can use other standard OATH-based tools to generate the 6-digit codes identical to what Symantec's official apps produce.

You can’t perform that action at this time.