Speakeasy 2.0.0 is a major update based on a Speakeasy fork, Passcode, by Michael Phan-Ba, which also incorporates code from another Node.js HOTP/TOTP module, notp, by Guy Halford-Thompson, with additional functionality and API compatibility changes made by Mark Bao. Speakeasy is now also moving to its own GitHub organization.
Speakeasy 2.0.0 is API-compatible with Speakeasy 1.x.x, but a number of functions are renamed and deprecated for consistency. See below. Future versions of Speakeasy 2.x.x may not be API-compatible with Speakeasy 1.x.x. Deprecation notices have been added.
- Added support for SHA256 and SHA512 hashing algorithms, and general support for other hashing algorithms. Thanks, JHTWebAdmin.
verifyfunctions from notp, adding verification window functionality which allows for the verification of tokens across a window (e.g. in HOTP, x tokens ahead, or in TOTP, x tokens ahead or behind).
verifyDeltafunctions which calculate a delta between a given token and where it was found within the window.
verifyfunctions which wrap
verifyDeltato return a boolean.
- Added tests for key generator.
- Added many more tests from Passcode and notp. All the above thanks to work from mikepb, guyht, and markbao.
typeto Google Authenticator otpauth:// URL. Thanks, Vincent Lombard.
- Added the output of a Google Authenticator–compatible otpauth:// URL to the key generator.
- Added a new function,
otpuathURL(), to output an otpauth:// URL.
- Added a new demo and a guide for how to use Speakeasy to implement two-factor authentication.
- Added code coverage testing with Istanbul.
v2.0.0 does not introduce any breaking changes, but deprecates a number of functions and parameters. Backwards compatibility is maintained for v2.0.0 but may not be maintained for future versions. While we highly recommend updating to 2.x.x, please make sure to update your
package.json to use Speakeasy at versions
^1.0.5 if you'd like to use the 1.x.x API.
hotp()now take the
hotp()now take the
totp()now takes the
generateSecret()no longer supports returning URLs to QR codes using
google_auth_qrsince passing the secret to a third party may be a security risk. Implement QR code generation on your own instead, such as by using a QR module like
- Now uses native Node.js buffers for converting encodings.
- Now uses
base32.jsNode package for base32 conversions.
- Moved location of main file to
- Moved digesting into a separate function.
- Documentation now uses JSDoc.
- Double-escape otpauth:// parameters for Google Authenticator otpauth:// URL. Thanks, cgarvey.