{"id":45657,"library":"onetimepass","title":"onetimepass","description":"A minimal library for generating and validating HOTP (HMAC-based One-Time Password) and TOTP (Time-based One-Time Password) tokens as per RFC 4226 and RFC 6238. Current version 1.0.1, last updated in 2015; no longer actively maintained.","status":"maintenance","version":"1.0.1","language":"python","source_language":"en","source_url":"https://github.com/tadeck/onetimepass","tags":["otp","totp","hotp","two-factor","authentication"],"install":[{"cmd":"pip install onetimepass","lang":"bash","label":"Install via pip"}],"dependencies":[],"imports":[{"note":"Common mistake: confusing with other OTP libraries","wrong":"from otp import valid_totp","symbol":"valid_totp","correct":"from onetimepass import valid_totp"},{"note":"Function is named get_totp, not totp","wrong":"from onetimepass import totp","symbol":"get_totp","correct":"from onetimepass import get_totp"}],"quickstart":{"code":"from onetimepass import valid_totp\nimport os\n\nsecret = os.environ.get('OTP_SECRET', 'JBSWY3DPEHPK3PXP')\ntoken = input('Enter token: ')\nif valid_totp(token, secret):\n    print('Valid!')\nelse:\n    print('Invalid.')","lang":"python","description":"Validate a TOTP token given a base32 secret."},"warnings":[{"fix":"Consider using pyotp instead, which is actively maintained.","message":"Library is unmaintained since 2015; does not support Python 3.11+ fully due to reliance on deprecated crypto packages.","severity":"deprecated","affected_versions":">=1.0.0"},{"fix":"Always use base32-encoded strings (e.g., from pyotp.random_base32()).","message":"The secret must be base32 encoded (string). Passing a raw bytes secret will fail silently or raise confusing errors.","severity":"gotcha","affected_versions":"all"},{"fix":"Synchronize clocks or use a library with drift support like pyotp.","message":"The function 'valid_totp' has no drift parameter; it only checks the current time window. If clock skew is an issue, tokens may fail.","severity":"breaking","affected_versions":"all"}],"env_vars":null,"search_vec":"'1.0.1':36 '2015':40 '4226':30 '6238':33 'activ':43 'authent':51 'base':12,21 'current':34 'factor':50 'generat':6 'hmac':11 'hmac-bas':10 'hotp':9,47 'last':37 'librari':4 'longer':42 'maintain':44 'minim':3 'one':14,23 'one-tim':13,22 'onetimepass':1 'otp':45 'password':16,25 'per':28 'rfc':29,32 'time':15,20,24 'time-bas':19 'token':26 'totp':18,46 'two':49 'two-factor':48 'updat':38 'valid':8 'version':35","created_at":"2026-06-07T12:56:05.070693+00:00","updated_at":"2026-06-07T12:56:05.070693+00:00","problems":[{"fix":"Ensure you installed onetimepass 1.0.1 and use: from onetimepass import valid_totp","cause":"Incorrect import or outdated version that doesn't have the function.","error":"AttributeError: module 'onetimepass' has no attribute 'valid_totp'"},{"fix":"Run: pip install onetimepass","cause":"The library is not installed.","error":"ImportError: No module named 'onetimepass'"},{"fix":"Convert secret to base32 string: base64.b32encode(secret).decode('utf-8')","cause":"Passing a non-base32 secret (e.g., raw bytes without encoding).","error":"TypeError: expected string or bytes-like object"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/tadeck/onetimepass/","github":"https://github.com/tadeck/onetimepass/","docs":null,"changelog":null,"pypi":null,"npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-29","last_verified":"2026-06-29","next_check":"2026-07-29","install_tag":null}}