PyOTP 2.10.0__py3-none-any.whl

pyotp/__init__.py

@@ -0,0 +1,115 @@
+import hashlib
+from re import split
+from typing import Any, Dict, Sequence
+from urllib.parse import parse_qsl, unquote, urlparse
+
+from . import contrib  # noqa:F401
+from .compat import random
+from .hotp import HOTP as HOTP
+from .otp import OTP as OTP
+from .totp import TOTP as TOTP
+
+
+def random_base32(length: int = 32, chars: Sequence[str] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567") -> str:
+    # Note: the otpauth scheme DOES NOT use base32 padding for secret lengths not divisible by 8.
+    # Some third-party tools have bugs when dealing with such secrets.
+    # We might consider warning the user when generating a secret of length not divisible by 8.
+    if length < 32:
+        raise ValueError("Secrets should be at least 160 bits")
+
+    return "".join(random.choice(chars) for _ in range(length))
+
+
+def random_hex(length: int = 40, chars: Sequence[str] = "ABCDEF0123456789") -> str:
+    if length < 40:
+        raise ValueError("Secrets should be at least 160 bits")
+    return random_base32(length=length, chars=chars)
+
+
+def parse_uri(uri: str) -> OTP:
+    """
+    Parses the provisioning URI for the OTP; works for either TOTP or HOTP.
+
+    See also:
+        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+
+    :param uri: the hotp/totp URI to parse
+    :returns: OTP object
+    """
+
+    # Secret (to be filled in later)
+    secret = None
+
+    # Encoder (to be filled in later)
+    encoder = None
+
+    # Digits (to be filled in later)
+    digits = None
+
+    # Data we'll parse to the correct constructor
+    otp_data: Dict[str, Any] = {}
+
+    # Parse the URI structure first, then unquote individual components.
+    # Unquoting the whole URI before splitting the label would turn an
+    # encoded colon (%3A) inside the issuer or account name into a literal
+    # ":" and mis-parse the issuer:account separator (see GitHub issue #174).
+    parsed_uri = urlparse(uri)
+
+    if parsed_uri.scheme != "otpauth":
+        raise ValueError("Not an otpauth URI")
+
+    # Parse issuer/accountname info. The label uses a literal ":" as the
+    # issuer:account separator; a percent-encoded "%3A" is a colon that is
+    # part of the issuer or account name, not a separator. Split on the
+    # literal ":" while the components are still percent-encoded, then
+    # unquote each component on its own.
+    accountinfo_parts = split(":", parsed_uri.path[1:], maxsplit=1)
+    if len(accountinfo_parts) == 1:
+        otp_data["name"] = unquote(accountinfo_parts[0])
+    else:
+        otp_data["issuer"] = unquote(accountinfo_parts[0])
+        otp_data["name"] = unquote(accountinfo_parts[1])
+
+    # Parse values
+    for key, value in parse_qsl(parsed_uri.query):
+        if key == "secret":
+            secret = value
+        elif key == "issuer":
+            if "issuer" in otp_data and otp_data["issuer"] is not None and otp_data["issuer"] != value:
+                raise ValueError("If issuer is specified in both label and parameters, it should be equal.")
+            otp_data["issuer"] = value
+        elif key == "algorithm":
+            if value == "SHA1":
+                otp_data["digest"] = hashlib.sha1
+            elif value == "SHA256":
+                otp_data["digest"] = hashlib.sha256
+            elif value == "SHA512":
+                otp_data["digest"] = hashlib.sha512
+            else:
+                raise ValueError("Invalid value for algorithm, must be SHA1, SHA256 or SHA512")
+        elif key == "encoder":
+            encoder = value
+        elif key == "digits":
+            digits = int(value)
+            otp_data["digits"] = digits
+        elif key == "period":
+            otp_data["interval"] = int(value)
+        elif key == "counter":
+            otp_data["initial_count"] = int(value)
+
+    if encoder != "steam":
+        if digits is not None and digits not in [6, 7, 8]:
+            raise ValueError("Digits may only be 6, 7, or 8")
+
+    if not secret:
+        raise ValueError("No secret found in URI")
+
+    # Create objects
+    if encoder == "steam":
+        return contrib.Steam(secret, **otp_data)
+    if parsed_uri.netloc == "totp":
+        return TOTP(secret, **otp_data)
+    elif parsed_uri.netloc == "hotp":
+        return HOTP(secret, **otp_data)
+
+    raise ValueError("Not a supported OTP type")

pyotp/compat.py

@@ -0,0 +1,9 @@
+import sys
+
+# Use secrets module if available (Python version >= 3.6) per PEP 506
+if sys.version_info >= (3, 6):
+    from secrets import SystemRandom
+else:
+    from random import SystemRandom
+
+random = SystemRandom()

pyotp/contrib/__init__.py

@@ -0,0 +1 @@
+from .steam import Steam  # noqa:F401

pyotp/contrib/steam.py

@@ -0,0 +1,40 @@
+import hashlib
+from typing import Optional
+
+from ..totp import TOTP
+
+STEAM_CHARS = "23456789BCDFGHJKMNPQRTVWXY"  # steam's custom alphabet
+STEAM_DEFAULT_DIGITS = 5  # Steam TOTP code length
+
+
+class Steam(TOTP):
+    """
+    Steam's custom TOTP. Subclass of `pyotp.totp.TOTP`.
+    """
+
+    def __init__(
+        self, s: str, name: Optional[str] = None, issuer: Optional[str] = None, interval: int = 30, digits: int = 5
+    ) -> None:
+        """
+        :param s: secret in base32 format
+        :param interval: the time interval in seconds for OTP. This defaults to 30.
+        :param name: account name
+        :param issuer: issuer
+        """
+        self.interval = interval
+        super().__init__(s=s, digits=10, digest=hashlib.sha1, name=name, issuer=issuer)
+
+    def generate_otp(self, input: int) -> str:
+        """
+        :param input: the HMAC counter value to use as the OTP input.
+            Usually either the counter, or the computed integer based on the Unix timestamp
+        """
+        int_code = int(super().generate_otp(input))
+        total_chars = len(STEAM_CHARS)
+
+        digits = []
+        for _ in range(STEAM_DEFAULT_DIGITS):
+            digits.append(STEAM_CHARS[int_code % total_chars])
+            int_code //= total_chars
+
+        return "".join(digits)

pyotp/hotp.py

@@ -0,0 +1,85 @@
+import hashlib
+from typing import Any, Optional
+
+from . import utils
+from .otp import OTP
+
+
+class HOTP(OTP):
+    """
+    Handler for HMAC-based OTP counters.
+    """
+
+    def __init__(
+        self,
+        s: str,
+        digits: int = 6,
+        digest: Any = None,
+        name: Optional[str] = None,
+        issuer: Optional[str] = None,
+        initial_count: int = 0,
+    ) -> None:
+        """
+        :param s: secret in base32 format
+        :param initial_count: starting HMAC counter value, defaults to 0
+        :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
+        :param name: account name
+        :param issuer: issuer
+        """
+        if digest is None:
+            digest = hashlib.sha1
+        elif digest in [hashlib.md5, hashlib.shake_128]:
+            raise ValueError("selected digest function must generate digest size greater than or equals to 18 bytes")
+
+        self.initial_count = initial_count
+        super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
+
+    def at(self, count: int) -> str:
+        """
+        Generates the OTP for the given count.
+
+        :param count: the OTP HMAC counter
+        :returns: OTP
+        """
+        return self.generate_otp(self.initial_count + count)
+
+    def verify(self, otp: str, counter: int) -> bool:
+        """
+        Verifies the OTP passed in against the current counter OTP.
+
+        :param otp: the OTP to check against
+        :param counter: the OTP HMAC counter
+        """
+        return utils.strings_equal(str(otp), str(self.at(counter)))
+
+    def provisioning_uri(
+        self,
+        name: Optional[str] = None,
+        initial_count: Optional[int] = None,
+        issuer_name: Optional[str] = None,
+        **kwargs,
+    ) -> str:
+        """
+        Returns the provisioning URI for the OTP.  This can then be
+        encoded in a QR Code and used to provision an OTP app like
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+
+        :param name: name of the user account
+        :param initial_count: starting HMAC counter value, defaults to 0
+        :param issuer_name: the name of the OTP issuer; this will be the
+            organization title of the OTP entry in Authenticator
+        :returns: provisioning URI
+        """
+        return utils.build_uri(
+            self.secret,
+            name=name if name else self.name,
+            initial_count=initial_count if initial_count else self.initial_count,
+            issuer=issuer_name if issuer_name else self.issuer,
+            algorithm=self.digest().name,
+            digits=self.digits,
+            **kwargs,
+        )

pyotp/otp.py

@@ -0,0 +1,72 @@
+import base64
+import hashlib
+import hmac
+from typing import Any, Optional
+
+
+class OTP(object):
+    """
+    Base class for OTP handlers.
+    """
+
+    def __init__(
+        self,
+        s: str,
+        digits: int = 6,
+        digest: Any = hashlib.sha1,
+        name: Optional[str] = None,
+        issuer: Optional[str] = None,
+    ) -> None:
+        self.digits = digits
+        if digits > 10:
+            raise ValueError("digits must be no greater than 10")
+        self.digest = digest
+        if digest in [hashlib.md5, hashlib.shake_128]:
+            raise ValueError("selected digest function must generate digest size greater than or equals to 18 bytes")
+        self.secret = s
+        self.name = name or "Secret"
+        self.issuer = issuer
+
+    def generate_otp(self, input: int) -> str:
+        """
+        :param input: the HMAC counter value to use as the OTP input.
+            Usually either the counter, or the computed integer based on the Unix timestamp
+        """
+        if input < 0:
+            raise ValueError("input must be positive integer")
+        hasher = hmac.new(self.byte_secret(), self.int_to_bytestring(input), self.digest)
+        if hasher.digest_size < 18:
+            raise ValueError("digest size is lower than 18 bytes, which will trigger error on otp generation")
+        hmac_hash = bytearray(hasher.digest())
+        offset = hmac_hash[-1] & 0xF
+        code = (
+            (hmac_hash[offset] & 0x7F) << 24
+            | (hmac_hash[offset + 1] & 0xFF) << 16
+            | (hmac_hash[offset + 2] & 0xFF) << 8
+            | (hmac_hash[offset + 3] & 0xFF)
+        )
+        str_code = str(10_000_000_000 + (code % 10**self.digits))
+        return str_code[-self.digits :]
+
+    def byte_secret(self) -> bytes:
+        secret = self.secret
+        missing_padding = len(secret) % 8
+        if missing_padding != 0:
+            secret += "=" * (8 - missing_padding)
+        return base64.b32decode(secret, casefold=True)
+
+    @staticmethod
+    def int_to_bytestring(i: int, padding: int = 8) -> bytes:
+        """
+        Turns an integer to the OATH specified
+        bytestring, which is fed to the HMAC
+        along with the secret
+        """
+        result = bytearray()
+        while i != 0:
+            result.append(i & 0xFF)
+            i >>= 8
+        # It's necessary to convert the final result from bytearray to bytes
+        # because the hmac functions in python 2.6 and 3.3 don't work with
+        # bytearray
+        return bytes(bytearray(reversed(result)).rjust(padding, b"\0"))

pyotp/totp.py

@@ -0,0 +1,118 @@
+import calendar
+import datetime
+import hashlib
+import time
+from typing import Any, Optional, Union
+
+from . import utils
+from .otp import OTP
+
+
+class TOTP(OTP):
+    """
+    Handler for time-based OTP counters.
+    """
+
+    def __init__(
+        self,
+        s: str,
+        digits: int = 6,
+        digest: Any = None,
+        name: Optional[str] = None,
+        issuer: Optional[str] = None,
+        interval: int = 30,
+    ) -> None:
+        """
+        :param s: secret in base32 format
+        :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
+        :param name: account name
+        :param issuer: issuer
+        :param interval: the time interval in seconds for OTP. This defaults to 30.
+        """
+        if digest is None:
+            digest = hashlib.sha1
+        elif digest in [hashlib.md5, hashlib.shake_128]:
+            raise ValueError("selected digest function must generate digest size greater than or equals to 18 bytes")
+
+        self.interval = interval
+        super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
+
+    def at(self, for_time: Union[int, datetime.datetime], counter_offset: int = 0) -> str:
+        """
+        Accepts either a Unix timestamp integer or a datetime object.
+
+        To get the time until the next timecode change (seconds until the current OTP expires), use this instead:
+
+        .. code:: python
+
+            totp = pyotp.TOTP(...)
+            time_remaining = totp.interval - datetime.datetime.now().timestamp() % totp.interval
+
+        :param for_time: the time to generate an OTP for
+        :param counter_offset: the amount of ticks to add to the time counter
+        :returns: OTP value
+        """
+        if not isinstance(for_time, datetime.datetime):
+            for_time = datetime.datetime.fromtimestamp(int(for_time))
+        return self.generate_otp(self.timecode(for_time) + counter_offset)
+
+    def now(self) -> str:
+        """
+        Generate the current time OTP
+
+        :returns: OTP value
+        """
+        return self.generate_otp(self.timecode(datetime.datetime.now()))
+
+    def verify(self, otp: str, for_time: Optional[datetime.datetime] = None, valid_window: int = 0) -> bool:
+        """
+        Verifies the OTP passed in against the current time OTP.
+
+        :param otp: the OTP to check against
+        :param for_time: Time to check OTP at (defaults to now)
+        :param valid_window: extends the validity to this many counter ticks before and after the current one
+        :returns: True if verification succeeded, False otherwise
+        """
+        if for_time is None:
+            for_time = datetime.datetime.now()
+
+        if valid_window:
+            for i in range(-valid_window, valid_window + 1):
+                if utils.strings_equal(str(otp), str(self.at(for_time, i))):
+                    return True
+            return False
+
+        return utils.strings_equal(str(otp), str(self.at(for_time)))
+
+    def provisioning_uri(self, name: Optional[str] = None, issuer_name: Optional[str] = None, **kwargs) -> str:
+        """
+        Returns the provisioning URI for the OTP.  This can then be
+        encoded in a QR Code and used to provision an OTP app like
+        Google Authenticator.
+
+        See also:
+            https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+
+        """
+        return utils.build_uri(
+            self.secret,
+            name if name else self.name,
+            issuer=issuer_name if issuer_name else self.issuer,
+            algorithm=self.digest().name,
+            digits=self.digits,
+            period=self.interval,
+            **kwargs,
+        )
+
+    def timecode(self, for_time: datetime.datetime) -> int:
+        """
+        Accepts either a timezone naive (`for_time.tzinfo is None`) or
+        a timezone aware datetime as argument and returns the
+        corresponding counter value (timecode).
+
+        """
+        if for_time.tzinfo:
+            return int(calendar.timegm(for_time.utctimetuple()) / self.interval)
+        else:
+            return int(time.mktime(for_time.timetuple()) / self.interval)

pyotp/utils.py

@@ -0,0 +1,91 @@
+import unicodedata
+from hmac import compare_digest
+from typing import Dict, Optional, Union
+from urllib.parse import quote, urlencode, urlparse
+
+
+def build_uri(
+    secret: str,
+    name: str,
+    initial_count: Optional[int] = None,
+    issuer: Optional[str] = None,
+    algorithm: Optional[str] = None,
+    digits: Optional[int] = None,
+    period: Optional[int] = None,
+    **kwargs,
+) -> str:
+    """
+    Returns the provisioning URI for the OTP; works for either TOTP or HOTP.
+
+    This can then be encoded in a QR Code and used to provision the Google
+    Authenticator app.
+
+    For module-internal use.
+
+    See also:
+        https://github.com/google/google-authenticator/wiki/Key-Uri-Format
+
+    :param secret: the hotp/totp secret used to generate the URI
+    :param name: name of the account
+    :param initial_count: starting counter value, defaults to None.
+        If none, the OTP type will be assumed as TOTP.
+    :param issuer: the name of the OTP issuer; this will be the
+        organization title of the OTP entry in Authenticator
+    :param algorithm: the algorithm used in the OTP generation.
+    :param digits: the length of the OTP generated code.
+    :param period: the number of seconds the OTP generator is set to
+        expire every code.
+    :param kwargs: other query string parameters to include in the URI
+    :returns: provisioning uri
+    """
+    # initial_count may be 0 as a valid param
+    is_initial_count_present = initial_count is not None
+
+    # Handling values different from defaults
+    is_algorithm_set = algorithm is not None and algorithm != "sha1"
+    is_digits_set = digits is not None and digits != 6
+    is_period_set = period is not None and period != 30
+
+    otp_type = "hotp" if is_initial_count_present else "totp"
+    base_uri = "otpauth://{0}/{1}?{2}"
+
+    url_args: Dict[str, Union[None, int, str]] = {"secret": secret}
+
+    label = quote(name)
+    if issuer is not None:
+        label = quote(issuer) + ":" + label
+        url_args["issuer"] = issuer
+
+    if is_initial_count_present:
+        url_args["counter"] = initial_count
+    if is_algorithm_set:
+        url_args["algorithm"] = algorithm.upper()  # type: ignore
+    if is_digits_set:
+        url_args["digits"] = digits
+    if is_period_set:
+        url_args["period"] = period
+    for k, v in kwargs.items():
+        if not isinstance(v, str):
+            raise ValueError("All otpauth uri parameters must be strings")
+        if k == "image":
+            image_uri = urlparse(v)
+            if image_uri.scheme != "https" or not image_uri.netloc or not image_uri.path:
+                raise ValueError("{} is not a valid url".format(image_uri))
+        url_args[k] = v
+
+    uri = base_uri.format(otp_type, label, urlencode(url_args).replace("+", "%20"))
+    return uri
+
+
+def strings_equal(s1: str, s2: str) -> bool:
+    """
+    Timing-attack resistant string comparison.
+
+    Normal comparison using == will short-circuit on the first mismatching
+    character. This avoids that by scanning the whole string, though we
+    still reveal to a timing attack whether the strings are the same
+    length.
+    """
+    s1 = unicodedata.normalize("NFKC", s1)
+    s2 = unicodedata.normalize("NFKC", s2)
+    return compare_digest(s1.encode("utf-8"), s2.encode("utf-8"))

pyotp-2.10.0.dist-info/METADATA

@@ -0,0 +1,220 @@
+Metadata-Version: 2.4
+Name: PyOTP
+Version: 2.10.0
+Summary: Python One Time Password Library
+Project-URL: Homepage, https://github.com/pyauth/pyotp
+Project-URL: Documentation, https://github.com/pyauth/pyotp
+Project-URL: Source Code, https://github.com/pyauth/pyotp
+Project-URL: Issue Tracker, https://github.com/pyauth/pyotp/issues
+Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/main/Changes.rst
+Author: Andrey Kislyuk
+Author-email: kislyuk@gmail.com
+Maintainer: Andrey Kislyuk
+Maintainer-email: kislyuk@gmail.com
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: POSIX
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.8
+Provides-Extra: test
+Requires-Dist: coverage; extra == 'test'
+Requires-Dist: mypy; extra == 'test'
+Requires-Dist: ruff; extra == 'test'
+Requires-Dist: wheel; extra == 'test'
+Description-Content-Type: text/x-rst
+
+PyOTP - The Python One-Time Password Library
+============================================
+
+PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
+or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
+
+Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
+Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
+Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
+sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
+Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
+compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
+<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
+
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
+  seen)
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
+- When implementing a "greenfield" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+  addition to or instead of HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which
+  strengthens your MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a
+  dedicated single-purpose device, which strengthens your clients against client-side attacks. And by automating scoping
+  of credentials to relying party IDs (application origin/domain names), U2F adds protection against phishing attacks.
+  One implementation of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet
+<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
+
+Quick overview of using One Time Passwords on your phone
+--------------------------------------------------------
+
+* OTPs involve a shared secret, stored both on the phone and the server
+* OTPs can be generated on a phone without internet connectivity
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
+  with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
+  Code
+
+Installation
+------------
+::
+
+    pip install pyotp
+
+Usage
+-----
+
+Time-based OTPs
+~~~~~~~~~~~~~~~
+::
+
+    import pyotp
+    import time
+
+    totp = pyotp.TOTP('base32secret3232')
+    totp.now() # => '492039'
+
+    # OTP verified for current time
+    totp.verify('492039') # => True
+    time.sleep(30)
+    totp.verify('492039') # => False
+
+Counter-based OTPs
+~~~~~~~~~~~~~~~~~~
+::
+
+    import pyotp
+    
+    hotp = pyotp.HOTP('base32secret3232')
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
+
+    # OTP verified with a counter
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
+
+Generating a Secret Key
+~~~~~~~~~~~~~~~~~~~~~~~
+A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
+OTP apps::
+
+    pyotp.random_base32()
+
+Some applications want the secret key to be formatted as a hex-encoded string::
+
+    pyotp.random_hex()  # returns a 40-character hex-encoded secret
+
+Google Authenticator Compatible
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+
+    pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
+
+    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
+
+    pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name="alice@google.com", issuer_name="Secure App", initial_count=0)
+
+    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
+
+This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
+scanned and added to the users list of OTP credentials.
+
+Parsing these URLs is also supported::
+
+    pyotp.parse_uri('otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App')
+
+    >>> <pyotp.totp.TOTP object at 0xFFFFFFFF>
+
+    pyotp.parse_uri('otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
+
+    >>> <pyotp.totp.HOTP object at 0xFFFFFFFF>
+
+Working example
+~~~~~~~~~~~~~~~
+
+Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
+
+.. image:: https://quickchart.io/qr?size=250&text=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+
+Now run the following and compare the output::
+
+    import pyotp
+    totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
+    print("Current OTP:", totp.now())
+
+Third-party contributions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following third-party contributions are not described by a standard, not officially supported, and provided for
+reference only:
+
+* ``pyotp.contrib.Steam()``: An implementation of Steam TOTP. Uses the same API as `pyotp.TOTP()`.
+
+Links
+~~~~~
+
+* `Project home page (GitHub) <https://github.com/pyauth/pyotp>`_
+* `Documentation <https://pyauth.github.io/pyotp/>`_
+* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
+* `Change log <https://github.com/pyauth/pyotp/blob/master/Changes.rst>`_
+* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
+* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
+* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
+* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
+* `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
+* `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
+
+For new applications:
+
+* `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+* `PyWARP <https://github.com/pyauth/pywarp>`_
+
+Versioning
+~~~~~~~~~~
+This package follows the `Semantic Versioning 2.0.0 <http://semver.org/>`_ standard. To control changes, it is
+recommended that application developers pin the package version and manage it using `pip-tools
+<https://github.com/jazzband/pip-tools>`_ or similar. For library developers, pinning the major version is
+recommended.
+
+.. image:: https://github.com/pyauth/pyotp/workflows/Python%20package/badge.svg
+        :target: https://github.com/pyauth/pyotp/actions
+.. image:: https://img.shields.io/codecov/c/github/pyauth/pyotp/master.svg
+        :target: https://codecov.io/github/pyauth/pyotp?branch=master
+.. image:: https://img.shields.io/pypi/v/pyotp.svg
+        :target: https://pypi.python.org/pypi/pyotp
+.. image:: https://img.shields.io/pypi/l/pyotp.svg
+        :target: https://pypi.python.org/pypi/pyotp
+.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
+        :target: https://pyotp.readthedocs.io/

pyotp-2.10.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+pyotp/__init__.py,sha256=KvbyPLPtAllp_9LfRzvsFAZJRxJGk3MvWIKwsteSJ2M,4254
+pyotp/compat.py,sha256=AB2ImrQE5tA9pUVGWKlKZDU1h5qpZHKGBUCpaRiJ3rY,217
+pyotp/hotp.py,sha256=krBp412C3pkF2caANi8MLJfnzynVn5CJltFDLTF6pwc,2825
+pyotp/otp.py,sha256=rdvDUU7atlf80eOowvZEoIipTrQKyLWrCyx48o6Nwb4,2542
+pyotp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+pyotp/totp.py,sha256=eYHhCrWzBLsEjHblnFj2LFi8lyerZgMiy0ND4UhVx6A,4234
+pyotp/utils.py,sha256=I9b_Ys5DLel6NgXiHGq_TE_0SZ01id8j-CTAxniU1Qs,3281
+pyotp/contrib/__init__.py,sha256=2hKOYyF4NnZ09Rw3FmeoYmk1l7l631cgIpj2kjzbKfw,38
+pyotp/contrib/steam.py,sha256=neSbrAjTdX4qb4iqOmmV00g8545GlIkQxIFesJn699M,1292
+pyotp-2.10.0.dist-info/METADATA,sha256=khIilotcerpIDbHpKIVEz2NAcDL63i4ZUxCxnIBlkmE,10149
+pyotp-2.10.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+pyotp-2.10.0.dist-info/licenses/LICENSE,sha256=eViFEjNBRYFyqtbr-rMbBxzHtAUkkp5pAWYtXbv1fqM,1174
+pyotp-2.10.0.dist-info/RECORD,,

pyotp-2.10.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

pyotp-2.10.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+Copyright (C) 2011-2021 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.