PyOTP 2.10.0__tar.gz

pyotp-2.10.0/.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: kislyuk

pyotp-2.10.0/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: Python package
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    env:
+      PIP_DISABLE_PIP_VERSION_CHECK: 1
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-latest, macos-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+    - run: make install
+    - run: make lint
+    - run: make test
+    - uses: codecov/codecov-action@v5
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/ruff-action@v3
+      - uses: astral-sh/ruff-action@v3
+        with:
+          args: "format --check"

pyotp-2.10.0/.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: Publish release to PyPI
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+jobs:
+  pypi-publish:
+    name: Build and upload release to PyPI
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+      - run: pip install build
+      - run: python -m build
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

pyotp-2.10.0/.gitignore

@@ -0,0 +1,42 @@
+# Reminder:
+# - A leading slash means the pattern is anchored at the root.
+# - No leading slash means the pattern matches at any depth.
+
+# Python files
+*.pyc
+__pycache__/
+.tox/
+*.egg-info/
+/build/
+/dist/
+/.eggs/
+
+# Sphinx documentation
+/docs/_build/
+
+# IDE project files
+/.pydevproject
+
+# vim python-mode plugin
+/.ropeproject
+
+# IntelliJ IDEA / PyCharm project files
+/.idea
+/*.iml
+
+# JS/node/npm/web dev files
+node_modules
+npm-debug.log
+
+# OS X metadata files
+.DS_Store
+
+# Python coverage
+.coverage
+htmlcov
+
+# Virtual environments
+venv
+
+# Type checking
+.mypy_cache

pyotp-2.10.0/Changes.rst

@@ -0,0 +1,187 @@
+Changes for v2.10.0 (2026-06-13)
+================================
+
+- Fix parse_uri mis-parsing of encoded colon in issuer/account name
+  (#187)
+
+- Simplified and improved generate_otp() performance in Steam class
+  (#179)
+
+- Check digest function to prevent error on OTP Generation (#170)
+
+- Ignore non-standard otpauth parameters
+
+- use strings as immutable default arguments (#162)
+
+Changes for v2.9.0 (2023-07-27)
+===============================
+
+-  Add ``parse_uri()`` support for Steam TOTP (#153)
+
+-  Test and documentation improvements
+
+Changes for v2.8.0 (2022-12-13)
+===============================
+
+-  Modify OTP generation to run in constant time (#148)
+
+-  Documentation improvements
+
+-  Drop Python 3.6 support; introduce Python 3.11 support
+
+Changes for v2.7.0 (2022-09-11)
+===============================
+
+-  Support Steam TOTP (#142)
+
+-  Build, test, and documentation updates
+
+Changes for v2.6.0 (2021-02-04)
+===============================
+
+-  Raise default and minimum base32 secret length to 32, and hex secret
+   length to 40 (160 bits as recommended by the RFC) (#115).
+
+-  Fix issue where provisioning_uri would return invalid results after
+   calling verify() (#115).
+
+Changes for v2.5.1 (2021-01-29)
+===============================
+
+-  parse_uri accepts and ignores optional image parameter (#114)
+
+Changes for v2.5.0 (2021-01-29)
+===============================
+
+-  Add optional image parameter to provisioning_uri (#113)
+
+-  Support for 7-digit codes in ‘parse_uri’ (#111)
+
+-  Raise default and minimum base32 secret length to 26
+
+Changes for v2.4.1 (2020-10-16)
+===============================
+
+-  parse_uri: Fix handling of period, counter (#108)
+
+-  Add support for timezone aware datetime as argument to
+   ``TOTP.timecode()`` (#107)
+
+Changes for v2.4.0 (2020-07-29)
+===============================
+
+-  Fix data type for at(for_time) (#85)
+
+-  Add support for parsing provisioning URIs (#84)
+
+-  Raise error when trying to generate secret that is too short (The
+   secret must be at least 128 bits)
+
+-  Add random_hex function (#82)
+
+Changes for v2.3.0 (2019-07-26)
+===============================
+
+-  Fix comparison behavior on Python 2.7
+
+Changes for v2.2.8 (2019-07-26)
+===============================
+
+-  Fix comparison of unicode chars (#78)
+
+-  Minor documentation and test fixes
+
+Changes for v2.2.7 (2018-11-05)
+===============================
+
+-  Have random_base32() use ‘secrets’ as rand source (#66)
+
+-  Documentation: Add security considerations, minimal security
+   checklist, other improvements
+
+-  Update setup.py to reference correct license
+
+Changes for v2.2.6 (2017-06-10)
+===============================
+
+-  Fix tests wrt double-quoting in provisioning URIs
+
+Changes for v2.2.5 (2017-06-03)
+===============================
+
+-  Quote issuer QS parameter in provisioning\_uri. Fixes #47.
+
+-  Raise an exception if a negative integer is passed to at() (#41).
+
+-  Documentation and release infrastructure improvements.
+
+Changes for v2.2.4 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+-  Fix release infra script, part 2
+
+Changes for v2.2.3 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+-  Fix release infra script
+
+Changes for v2.2.2 (2017-01-04)
+===============================
+
+-  Restore Python 2.6 compatibility (however, Python 2.6 is not
+   supported)
+
+-  Documentation and test improvements
+
+Changes for v2.2.1 (2016-08-30)
+===============================
+
+-  Avoid using python-future; it has subdependencies that limit
+   compatibility (#34)
+-  Make test suite pass on 32-bit platforms (#30)
+-  Timing attack resistance fix: don't reveal string length to attacker.
+   Thanks to Eeo Jun (#28).
+-  Support algorithm, digits, period parameters in provisioning\_uri.
+   Thanks to Dionisio E Alonso (#33).
+-  Minor style and packaging infrastructure fixes.
+
+Changes for v2.2.0 (2016-08-30)
+===============================
+
+-  See v2.2.1
+
+Version 2.1.0 (2016-05-02)
+--------------------------
+- Add extended range support to TOTP.verify. Thanks to Zeev Rotshtein (PR #19).
+- Handle missing padding of encoded secret. Thanks to Kun Yan (#20).
+- Miscellaneous fixes.
+
+Version 2.0.1 (2015-09-28)
+--------------------------
+- Fix packaging issue in v2.0.0 that prevented installation with easy_install.
+
+Version 2.0.0 (2015-08-22)
+--------------------------
+- The ``pyotp.HOTP.at()``, ``pyotp.TOTP.at()``, and
+  ``pyotp.TOTP.now()`` methods now return strings instead of
+  integers. Thanks to Rohan Dhaimade (PR #16).
+
+Version 1.4.2 (2015-07-21)
+--------------------------
+- Begin tracking changes in change log.
+- Update documentation.
+- Introduce Travis CI integration.
+
+Version 1.3.1 (2012-02-29)
+--------------------------
+- Initial release.

pyotp-2.10.0/LICENSE

@@ -0,0 +1,21 @@
+Copyright (C) 2011-2021 Mark Percival <m@mdp.im>,
+Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
+and PyOTP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

pyotp-2.10.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include LICENSE
+include README.rst
+include test.py

pyotp-2.10.0/Makefile

@@ -0,0 +1,31 @@
+SHELL=/bin/bash
+
+test_deps:
+	python -m pip install .[test]
+
+lint:
+	ruff check src
+	mypy --install-types --non-interactive --check-untyped-defs src
+
+test:
+	coverage run --branch --include 'src/*' -m unittest discover -s test -v
+
+init_docs:
+	cd docs; sphinx-quickstart
+
+docs:
+	python -m pip install furo sphinx-copybutton sphinxext-opengraph
+	sphinx-build docs docs/html
+
+install: clean
+	python -m pip install build
+	python -m build
+	python -m pip install --upgrade $$(echo dist/*.whl)[test]
+
+clean:
+	-rm -rf build dist
+	-rm -rf *.egg-info
+
+.PHONY: test_deps lint test docs install clean
+
+include common.mk

pyotp-2.10.0/PKG-INFO

@@ -0,0 +1,220 @@
+Metadata-Version: 2.4
+Name: PyOTP
+Version: 2.10.0
+Summary: Python One Time Password Library
+Project-URL: Homepage, https://github.com/pyauth/pyotp
+Project-URL: Documentation, https://github.com/pyauth/pyotp
+Project-URL: Source Code, https://github.com/pyauth/pyotp
+Project-URL: Issue Tracker, https://github.com/pyauth/pyotp/issues
+Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/main/Changes.rst
+Author: Andrey Kislyuk
+Author-email: kislyuk@gmail.com
+Maintainer: Andrey Kislyuk
+Maintainer-email: kislyuk@gmail.com
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: POSIX
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python :: Implementation :: PyPy
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.8
+Provides-Extra: test
+Requires-Dist: coverage; extra == 'test'
+Requires-Dist: mypy; extra == 'test'
+Requires-Dist: ruff; extra == 'test'
+Requires-Dist: wheel; extra == 'test'
+Description-Content-Type: text/x-rst
+
+PyOTP - The Python One-Time Password Library
+============================================
+
+PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA)
+or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.
+
+Open MFA standards are defined in `RFC 4226 <https://tools.ietf.org/html/rfc4226>`_ (HOTP: An HMAC-Based One-Time
+Password Algorithm) and in `RFC 6238 <https://tools.ietf.org/html/rfc6238>`_ (TOTP: Time-Based One-Time Password
+Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by
+sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use `Google
+Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>`_, `Authy <https://www.authy.com/>`_, or another
+compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan `otpauth://
+<https://github.com/google/google-authenticator/wiki/Key-Uri-Format>`_ QR codes provided by PyOTP.
+
+Implementers should read and follow the `HOTP security requirements <https://tools.ietf.org/html/rfc4226#section-7>`_
+and `TOTP security considerations <https://tools.ietf.org/html/rfc6238#section-5>`_ sections of the relevant RFCs. At
+minimum, application implementers should follow this checklist:
+
+- Ensure transport confidentiality by using HTTPS
+- Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
+  seen)
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
+- When implementing a "greenfield" application, consider supporting
+  `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
+  addition to or instead of HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which
+  strengthens your MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a
+  dedicated single-purpose device, which strengthens your clients against client-side attacks. And by automating scoping
+  of credentials to relying party IDs (application origin/domain names), U2F adds protection against phishing attacks.
+  One implementation of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+
+We also recommend that implementers read the
+`OWASP Authentication Cheat Sheet
+<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
+authentication best practices.
+
+Quick overview of using One Time Passwords on your phone
+--------------------------------------------------------
+
+* OTPs involve a shared secret, stored both on the phone and the server
+* OTPs can be generated on a phone without internet connectivity
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
+  with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
+  Code
+
+Installation
+------------
+::
+
+    pip install pyotp
+
+Usage
+-----
+
+Time-based OTPs
+~~~~~~~~~~~~~~~
+::
+
+    import pyotp
+    import time
+
+    totp = pyotp.TOTP('base32secret3232')
+    totp.now() # => '492039'
+
+    # OTP verified for current time
+    totp.verify('492039') # => True
+    time.sleep(30)
+    totp.verify('492039') # => False
+
+Counter-based OTPs
+~~~~~~~~~~~~~~~~~~
+::
+
+    import pyotp
+    
+    hotp = pyotp.HOTP('base32secret3232')
+    hotp.at(0) # => '260182'
+    hotp.at(1) # => '055283'
+    hotp.at(1401) # => '316439'
+
+    # OTP verified with a counter
+    hotp.verify('316439', 1401) # => True
+    hotp.verify('316439', 1402) # => False
+
+Generating a Secret Key
+~~~~~~~~~~~~~~~~~~~~~~~
+A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
+OTP apps::
+
+    pyotp.random_base32()
+
+Some applications want the secret key to be formatted as a hex-encoded string::
+
+    pyotp.random_hex()  # returns a 40-character hex-encoded secret
+
+Google Authenticator Compatible
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+
+    pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
+
+    >>> 'otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App'
+
+    pyotp.hotp.HOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name="alice@google.com", issuer_name="Secure App", initial_count=0)
+
+    >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
+
+This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
+scanned and added to the users list of OTP credentials.
+
+Parsing these URLs is also supported::
+
+    pyotp.parse_uri('otpauth://totp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App')
+
+    >>> <pyotp.totp.TOTP object at 0xFFFFFFFF>
+
+    pyotp.parse_uri('otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
+
+    >>> <pyotp.totp.HOTP object at 0xFFFFFFFF>
+
+Working example
+~~~~~~~~~~~~~~~
+
+Scan the following barcode with your phone's OTP app (e.g. Google Authenticator):
+
+.. image:: https://quickchart.io/qr?size=250&text=otpauth%3A%2F%2Ftotp%2Falice%40google.com%3Fsecret%3DJBSWY3DPEHPK3PXP
+
+Now run the following and compare the output::
+
+    import pyotp
+    totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
+    print("Current OTP:", totp.now())
+
+Third-party contributions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following third-party contributions are not described by a standard, not officially supported, and provided for
+reference only:
+
+* ``pyotp.contrib.Steam()``: An implementation of Steam TOTP. Uses the same API as `pyotp.TOTP()`.
+
+Links
+~~~~~
+
+* `Project home page (GitHub) <https://github.com/pyauth/pyotp>`_
+* `Documentation <https://pyauth.github.io/pyotp/>`_
+* `Package distribution (PyPI) <https://pypi.python.org/pypi/pyotp>`_
+* `Change log <https://github.com/pyauth/pyotp/blob/master/Changes.rst>`_
+* `RFC 4226: HOTP: An HMAC-Based One-Time Password <https://tools.ietf.org/html/rfc4226>`_
+* `RFC 6238: TOTP: Time-Based One-Time Password Algorithm <https://tools.ietf.org/html/rfc6238>`_
+* `ROTP <https://github.com/mdp/rotp>`_ - Original Ruby OTP library by `Mark Percival <https://github.com/mdp>`_
+* `OTPHP <https://github.com/lelag/otphp>`_ - PHP port of ROTP by `Le Lag <https://github.com/lelag>`_
+* `OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_
+* `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_
+
+For new applications:
+
+* `WebAuthn <https://www.w3.org/TR/webauthn/>`_
+* `PyWARP <https://github.com/pyauth/pywarp>`_
+
+Versioning
+~~~~~~~~~~
+This package follows the `Semantic Versioning 2.0.0 <http://semver.org/>`_ standard. To control changes, it is
+recommended that application developers pin the package version and manage it using `pip-tools
+<https://github.com/jazzband/pip-tools>`_ or similar. For library developers, pinning the major version is
+recommended.
+
+.. image:: https://github.com/pyauth/pyotp/workflows/Python%20package/badge.svg
+        :target: https://github.com/pyauth/pyotp/actions
+.. image:: https://img.shields.io/codecov/c/github/pyauth/pyotp/master.svg
+        :target: https://codecov.io/github/pyauth/pyotp?branch=master
+.. image:: https://img.shields.io/pypi/v/pyotp.svg
+        :target: https://pypi.python.org/pypi/pyotp
+.. image:: https://img.shields.io/pypi/l/pyotp.svg
+        :target: https://pypi.python.org/pypi/pyotp
+.. image:: https://readthedocs.org/projects/pyotp/badge/?version=latest
+        :target: https://pyotp.readthedocs.io/