A .NET library for generating and validating TOTP and HOTP codes, commonly used for two-factor authentication.
Otp.NET is a .NET library that implements TOTP (Timed One-Time Password) and HOTP (HMAC-based One-Time Password) algorithms for generating and validating one-time codes. It solves the need for secure two-factor authentication in .NET applications by providing RFC-compliant methods to create and verify time-based or counter-based passwords.
.NET developers building applications that require two-factor authentication, such as web apps, mobile apps using Mono, or server-side systems that need to validate OTP codes.
Developers choose Otp.NET for its strict adherence to RFC standards, flexibility in configuration (hash algorithms, time steps, code length), and built-in features like time correction and verification windows, making it a reliable and easy-to-integrate solution for OTP-based security.
A .NET implementation of TOTP and HOTP for things like two-factor authentication codes.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements TOTP (RFC 6238) and HOTP (RFC 4226) accurately, ensuring interoperability with standards-based systems like Google Authenticator, as emphasized in the README.
Supports multiple hash algorithms (SHA1, SHA256, SHA512), adjustable time steps, and code lengths via constructor parameters, allowing customization for different security needs.
Includes TimeCorrection for clock skew and VerificationWindow for network delays, addressing real-world deployment issues described in the RFC recommendations.
Generates OTP URIs in the Key Uri Format, simplifying setup with apps like Google Authenticator, and provides Base32 encoding utilities for key management.
The library does not handle one-time use tracking; developers must implement their own storage for timeWindowUsed, as cautioned in the README's verification section.
The README explicitly warns that features like custom time steps or code sizes have 'not a lot of tests,' risking reliability in non-standard configurations.
Tied to C# and .NET, making it unsuitable for projects in other languages or requiring cross-platform OTP generation outside this ecosystem.