An RFC 6328 compliant Two Factor authentication code generator. Implemented purely in Javascript. There are existing generators, e.g. the totp.js however, usually they depend on external libraries that support at least

• base32 encoding and decoding
• hmacsha1 signatures

The totp_light has no additional external dependencies, all you need is the totp.js.

• works in node.js (uses crypto module)
• works in a browser (uses subtle.crypto)
• TOTP code generation based on known master key (these are usually base32 encoded)
• no QR codes or any extra stuff

const key  = '2JLXFRTKDX7EVJ2ZRETEW655JA';
const totp = new TOTP(key);

// generate code
const code = await totp.gen();
console.log( code );

A: Yes, this implementation works correctly as a code generator for Google/Microsoft Authenticators.

A: Both, depending on what you want to do. If you implement a server-side node.js app, you generate codes server side and validate codes sent by users (which are generated at client-side with compliant applications like Google/Microsoft Authenticator). If you implement a client-side replacement for Google/Microsoft Authenticator, codes generated with this library will be exactly the same as codes generated with Google/Microsoft Authenticators.

• totp.js - actual TOTP implementation
• test.html + client.js - browser demo
• app.js - node.js demo

Initial release

• validation should consider a time window to catch codes that are ±5 minutes from the current code