A lightweight Java library for generating and verifying HOTP and TOTP one-time passwords compliant with RFC 4226 and RFC 6238.
OTP-Java is a Java library for generating and verifying one-time passwords used in two-factor authentication systems. It implements both HMAC-based one-time passwords (HOTP) as defined in RFC 4226 and time-based one-time passwords (TOTP) as per RFC 6238. The library simplifies adding OTP functionality to Java applications with a clean, builder-based API.
Java developers building applications that require two-factor authentication, such as web services, APIs, or enterprise systems needing secure user login flows.
Developers choose OTP-Java for its minimal footprint, strict compliance with RFC standards, and ease of integration—offering a pure Java solution without external dependencies. Its support for OTPAuth URIs and flexible configuration makes it ideal for projects requiring reliable, standards-based OTP generation.
A small and easy-to-use one-time password generator library for Java implementing RFC 4226 (HOTP) and RFC 6238 (TOTP).
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements both HOTP (RFC 4226) and TOTP (RFC 6238), ensuring compatibility with industry-standard authenticator apps and adherence to specifications.
Has no external dependencies, making it lightweight and easy to integrate without adding bloat, as emphasized in the philosophy section.
Uses builder patterns to customize password length, HMAC algorithms (SHA1, SHA256, SHA512), and time periods, with clear examples in the usage section.
Supports creating and parsing OTPAuth URIs for seamless onboarding with authenticator apps, as demonstrated in the generation and initialization examples.
The README explicitly states recovery code generation is not included, requiring separate implementation for complete 2FA systems, which adds development overhead.
Being a standalone library, it lacks built-in integrations with popular frameworks like Spring Security, necessitating custom setup for seamless use in enterprise applications.
Methods throw generic IllegalStateException without detailed error context, as seen in code snippets, which can complicate debugging and error management.