TOTP is the most common way of doing two-factor authentication (2FA) today. To demystify what happens behind the scenes when you provide the website with the six digits generated by your 2FA app, read more in the accompanying blog post.

This repository provides a Pythonic implementation of the TOTP standard. TOTP inherently uses a truncated HMAC of the current timestamp (floored to the last 30-th-second instance), with a shared secret key. Ideally, this key is known only by the token presenter (i.e., where the token is generated and who uses the token as proof) and the token verifier (i.e., the system requiring the user to provide proof).

This is a very simple algorithm, and can be implemented easily. See totp.py for the reference algorithm implementation.

On the other hand, developing a system using this algorithm is a lot more complex, and it is that system which needs to be secured in order to secure your second factor. See the Security Considerations section in the blog post for more information.

TOTP Standard - RFC 6238

HOTP Standard - Section 5.3 provides the reference for truncate function - RFC 4226