Golang OTP(One-Time Password) Library.
Clone or download
Latest commit c8557ba Oct 30, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
example Generate random secret May 5, 2018
.gitignore init commit Apr 23, 2018
.travis.yml travis ci Apr 23, 2018
LICENSE Initial commit Apr 23, 2018
README.md Generate random secret May 5, 2018
doc.go update readme Apr 23, 2018
hotp.go implement hotp Apr 23, 2018
hotp_test.go update test Apr 23, 2018
otp.go implement totp: time-based otp Apr 23, 2018
totp.go Added TOTP expiration time stamp return Oct 29, 2018
totp_test.go Added TOTP expiration time stamp return Oct 29, 2018
utils.go RandomSecret comment May 5, 2018
utils_test.go update test Apr 23, 2018


GOTP - The Golang One-Time Password Library

build-status MIT License

GOTP is a Golang package for generating and verifying one-time passwords. It can be used to implement two-factor (2FA) or multi-factor (MFA) authentication methods in anywhere that requires users to log in.

Open MFA standards are defined in RFC 4226 (HOTP: An HMAC-Based One-Time Password Algorithm) and in RFC 6238 (TOTP: Time-Based One-Time Password Algorithm). GOTP implements server-side support for both of these standards.

GOTP was inspired by PyOTP.


$ go get github.com/xlzd/gotp


Check API docs at https://godoc.org/github.com/xlzd/gotp

Time-based OTPs

totp := gotp.NewDefaultTOTP("4S62BZNFXXSZLCRO")
totp.Now()  // current otp '123456'
totp.At(1524486261)  // otp of timestamp 1524486261 '123456'

# OTP verified for a given timestamp
totp.Verify('492039', 1524486261)  // true
totp.Verify('492039', 1520000000)  // false

// generate a provisioning uri
totp.ProvisioningUri("demoAccountName", "issuerName")
// otpauth://totp/issuerName:demoAccountName?secret=4S62BZNFXXSZLCRO&issuer=issuerName

Counter-based OTPs

hotp := gotp.NewDefaultHOTP("4S62BZNFXXSZLCRO")
hotp.At(0)  // '944181'
hotp.At(1)  // '770975'

# OTP verified for a given timestamp
hotp.Verify('944181', 0)  // true
hotp.Verify('944181', 1)  // false

// generate a provisioning uri
hotp.ProvisioningUri("demoAccountName", "issuerName", 1)
// otpauth://hotp/issuerName:demoAccountName?secret=4S62BZNFXXSZLCRO&counter=1&issuer=issuerName

Generate random secret

secretLength := 16
gotp.RandomSecret(secretLength) // LMT4URYNZKEWZRAA

Google Authenticator Compatible

GOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. GOTP includes the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps via otpObj.ProvisioningUri method:

gotp.NewDefaultTOTP("4S62BZNFXXSZLCRO").ProvisioningUri("demoAccountName", "issuerName")
// otpauth://totp/issuerName:demoAccountName?secret=4S62BZNFXXSZLCRO&issuer=issuerName

gotp.NewDefaultHOTP("4S62BZNFXXSZLCRO").ProvisioningUri("demoAccountName", "issuerName", 1)
// otpauth://hotp/issuerName:demoAccountName?secret=4S62BZNFXXSZLCRO&counter=1&issuer=issuerName

This URL can then be rendered as a QR Code which can then be scanned and added to the users list of OTP credentials.

Working example

Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):


Now run the following and compare the output:

package main

import (

func main() {
	fmt.Println("Current OTP is", gotp.NewDefaultTOTP("4S62BZNFXXSZLCRO").Now())


GOTP is licensed under the MIT License