PyOTP

Python One Time Password Library

pyotp Permissive license MIT Active ★ 3,328 v2.10.0 released 2026-06-14

Install

pyotp on PyPI

pip

pip install pyotp

uv

uv add pyotp

poetry

poetry add pyotp

Package facts

License	MIT (permissive)
Python support	supports the current Python release (>=3.8)
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	actively maintained — 60 days since the last release
Last repo commit	2026-06-29
First released	2011-09-26
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: pyotp-2.10.0-py3-none-any.whl

Development Status :: 5 - Production/StableIntended Audience :: DevelopersOperating System :: MacOS :: MacOS XOperating System :: POSIXProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Software DevelopmentTopic :: Software Development :: Libraries :: Python Modules

About PyOTP

from the package's own PyPI description — quoted content, verbatim

PyOTP - The Python One-Time Password Library

PyOTP is a Python library for generating and verifying one-time passwords. It can be used to implement two-factor (2FA) or multi-factor (MFA) authentication methods in web applications and in other systems that require users to log in.

Open MFA standards are defined in RFC 4226 <https://tools.ietf.org/html/rfc4226> (HOTP: An HMAC-Based One-Time Password Algorithm) and in RFC 6238 <https://tools.ietf.org/html/rfc6238> (TOTP: Time-Based One-Time Password Algorithm). PyOTP implements server-side support for both of these standards. Client-side support can be enabled by sending authentication codes to users over SMS or email (HOTP) or, for TOTP, by instructing users to use Google Authenticator <https://en.wikipedia.org/wiki/Google_Authenticator>, Authy <https://www.authy.com/>, or another compatible app. Users can set up auth tokens in their apps easily by using their phone camera to scan otpauth:// <https://github.com/google/google-authenticator/wiki/Key-Uri-Format>_ QR codes provided by PyOTP.

Implementers should read and follow the `HOTP security requirements...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

PyOTP generates and verifies one-time passwords (HOTP and TOTP) for implementing two-factor and multi-factor authentication in web applications and other systems, compatible with Google Authenticator and similar OTP apps.

Installation is frictionless: PyOTP has zero runtime dependencies and ships as a pure-Python wheel. The package is actively maintained with a recent release and a history since 2011.

PyOTP is licensed under MIT, a permissive license that permits commercial and private use with minimal restrictions, making it suitable for proprietary applications.

Usage

pip install pyotp

import pyotp
totp = pyotp.TOTP('base32secret3232')
print(totp.now())  # Current OTP
print(totp.verify('492039'))  # Verify OTP

Requires Python 3.8 or later; base32 secret must be a valid base32-encoded string.

Verdict: PyOTP is a mature, well-maintained library with zero dependencies, permissive licensing, and no known vulnerabilities. It implements RFC-standard HOTP and TOTP algorithms and integrates seamlessly with mainstream authenticator apps. Suitable for production use in authentication systems.

Needs verification

Whether the package's security guidance (RFC compliance, replay attack prevention, rate limiting) is actively enforced or left to the caller.
Performance characteristics under high-volume OTP generation or verification workloads.

two factor authentication libraryone time password generationtotp hotp implementationgoogle authenticator compatiblemfa authentication pythonotp verification servertime based one time password