public final class Otp

Object
Otp

Counter-based (HOTP, RFC 4226) and time-based (TOTP, RFC 6238) one-time password generators. Compatible with any standard authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, etc.).

Generate a 6-digit Google-Authenticator-compatible code

byte[] secret = Base32.decode("JBSWY3DPEHPK3PXP"); // shared secret
String code = Otp.totp(secret); // default 6 digits, 30 second step,
                                // SHA-1, current time

Verify a code (allowing +/-1 step of clock skew)

boolean ok = Otp.verifyTotp(secret, userInput, 1);

Methods

`public static` `String hotp(byte[] secret, long counter, int digits)`	Generates an HOTP code (RFC 4226) using SHA-1 and the given digit count.
`public static` `String hotp(byte[] secret, long counter, int digits, String hashAlgorithm)`	Generates an HOTP code with a configurable hash algorithm.
`public static` `String totp(byte[] secret)`	Generates a TOTP code (RFC 6238) for the current system time, using SHA-1, 6 digits and a 30-second step.
`public static` `String totp(byte[] secret, int digits, int stepSeconds)`	Generates a TOTP code for the current system time with a custom digit count and step size.
`public static` `String totp(byte[] secret, long currentTimeMillis, int stepSeconds, int digits, String hashAlgorithm)`	Generates a TOTP code with full control over all parameters.
`public static boolean verifyTotp(byte[] secret,` `String code, int tolerance)`	Verifies a TOTP code, allowing `tolerance` steps of clock skew on either side of `now` (so a tolerance of 1 will accept the previous, current and next code).
`public static` `String otpauthUri(String issuer, String accountName, byte[] secret, int digits, int stepSeconds, String hashAlgorithm)`	Builds the canonical `otpauth://totp/...` URI that authenticator apps (Google Authenticator, Microsoft Authenticator, 1Password, Authy, …) consume when the user scans a QR code on your enrolment screen.
`public static` `String otpauthUri(String issuer, String accountName, byte[] secret)`	Convenience overload using the typical 6 digits / 30 seconds / SHA-1 settings most authenticator apps expect.
`public static boolean verifyTotp(byte[] secret,` `String code, int tolerance, long currentTimeMillis, int stepSeconds, int digits, String hashAlgorithm)`	Verifies a TOTP code with full parameter control.

Inherited methods

From Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait, clone

Method details

hotp

public static String hotp(byte[] secret, long counter, int digits)

Generates an HOTP code (RFC 4226) using SHA-1 and the given digit count.

Parameters

secret byte[]: the shared secret
counter long: the moving factor – caller is responsible for incrementing it after every successful authentication
digits int: number of decimal digits in the output (typically 6, may be 6, 7 or 8)

hotp

public static String hotp(byte[] secret, long counter, int digits, String hashAlgorithm)

Generates an HOTP code with a configurable hash algorithm. Most authenticator apps assume SHA-1; only override if the issuer publishes a different algorithm parameter in its provisioning URI.

totp

public static String totp(byte[] secret)

Generates a TOTP code (RFC 6238) for the current system time, using SHA-1, 6 digits and a 30-second step.

totp

public static String totp(byte[] secret, int digits, int stepSeconds)

Generates a TOTP code for the current system time with a custom digit count and step size.

totp

public static String totp(byte[] secret, long currentTimeMillis, int stepSeconds, int digits, String hashAlgorithm)

Generates a TOTP code with full control over all parameters.

Parameters

secret byte[]: shared secret
currentTimeMillis long: timestamp to derive the code from
stepSeconds int: window size – 30 in the vast majority of deployments
digits int: number of decimal digits in the output (typically 6 or 8)
hashAlgorithm String: hash to use – almost always Hash.SHA1

verifyTotp

public static boolean verifyTotp(byte[] secret, String code, int tolerance)

Verifies a TOTP code, allowing tolerance steps of clock skew on either side of now (so a tolerance of 1 will accept the previous, current and next code).

otpauthUri

public static String otpauthUri(String issuer, String accountName, byte[] secret, int digits, int stepSeconds, String hashAlgorithm)

Builds the canonical otpauth://totp/... URI that authenticator apps (Google Authenticator, Microsoft Authenticator, 1Password, Authy, …) consume when the user scans a QR code on your enrolment screen. The format is documented at https://github.com/google/google-authenticator/wiki/Key-Uri-Format.

Render the returned string as a QR code (server-side render, or a QR-generation cn1lib) and show it to the user; they scan it, the authenticator stores secret against the issuer:accountName label, and from then on it produces six-digit codes that match [#totp(byte[])] on your side using the same secret.

Parameters

issuer String: the human-readable service name shown in the authenticator (“Acme Bank”). Must not contain a :.
accountName String: the user’s identifier within your service (“alice@example.com”). Must not contain a :.
secret byte[]: shared secret (the bytes you also pass to [#totp(byte[])]) – encoded as Base32 in the URI per the spec.
digits int: number of digits in each code (typically 6).
stepSeconds int: time-step size, typically 30.
hashAlgorithm String: hash, typically Hash.SHA1 for authenticator compatibility. SHA-256 and SHA-512 are accepted but not all authenticator apps support them.

otpauthUri

public static String otpauthUri(String issuer, String accountName, byte[] secret)

Convenience overload using the typical 6 digits / 30 seconds / SHA-1 settings most authenticator apps expect.

verifyTotp

public static boolean verifyTotp(byte[] secret, String code, int tolerance, long currentTimeMillis, int stepSeconds, int digits, String hashAlgorithm)

Verifies a TOTP code with full parameter control.