RFC-compliant TOTP library for Rust with QR code generation, otpauth URL parsing, and Steam support.
totp-rs is a Rust library for generating and verifying Time-based One-Time Passwords (TOTP) for two-factor authentication (2FA). It implements the TOTP standard (RFC 6238) with configurable parameters like time skew, token validity, algorithm, and digit count, enabling secure 2FA integration into Rust applications.
Rust developers building applications that require two-factor authentication, such as web services, APIs, or command-line tools needing secure user verification.
Developers choose totp-rs for its balance of ease of use and extensive configurability, with a lightweight default feature set for small binaries and fast compilation, plus optional features like QR code generation, otpauth URL support, and Steam TOTP for flexibility.
RFC-compliant TOTP implementation with ease of use as a goal and additionnal QoL features.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements the TOTP standard (RFC 6238) with configurable time skew, algorithm, and digit count, ensuring interoperability with authenticator apps and services.
Supports both raw byte and Base32-encoded secrets via the Secret type, simplifying integration with various storage formats and reducing preprocessing overhead.
Optional feature to generate Base64 PNG QR codes directly, enabling easy user setup in authenticator apps without external libraries or services.
Specialized functionality for generating Steam Guard tokens, catering specifically to gaming platforms and services that use Steam's authentication system.
The README warns that some authenticator apps may accept SHA256/SHA512 but silently fallback to SHA1, causing verification failures unless developers account for this inconsistency.
Core functionalities like QR code generation, otpauth support, and secret generation are behind optional features, complicating dependency management and potentially bloating binaries if not carefully controlled.
Only supports Time-based OTPs, not other 2FA methods like HOTP or hardware tokens, which may restrict its use in broader or hybrid authentication systems.