TypeScript icon, indicating that this package has built-in type declarations

    2.0.2 • Public • Published


    Easy 2-Factor Integration For Node.js

    There are a number of applications which support 2-Factor Authentication, namely

    This module uses notp which implements TOTP (RFC 6238) (the Authenticator standard), which is based on HOTP (RFC 4226) to provide codes that are exactly compatible with all other Authenticator apps and services that use them.


    npm install node-2fa --save
    const twofactor = require("node-2fa");
    const newSecret = twofactor.generateSecret({ name: "My Awesome App", account: "johndoe" });
      uri: 'otpauth://totp/My%20Awesome%20App:johndoe?secret=XDQXYCP5AC6FA32FQXDGJSPBIDYNKK5W&issuer=My%20Awesome%20App',
      qr: '|0&cht=qr&chl=otpauth://totp/My%20Awesome%20App:johndoe%3Fsecret=XDQXYCP5AC6FA32FQXDGJSPBIDYNKK5W%26issuer=My%20Awesome%20App'
    const newToken = twofactor.generateToken("XDQXYCP5AC6FA32FQXDGJSPBIDYNKK5W");
    // => { token: '630618' }
    twofactor.verifyToken("XDQXYCP5AC6FA32FQXDGJSPBIDYNKK5W", "630618");
    // => { delta: 0 }
    twofactor.verifyToken("XDQXYCP5AC6FA32FQXDGJSPBIDYNKK5W", "00");
    // => null



    returns an object containing a 32-character secret (keep user specific, store in DB), a uri (if you want to make your own QR / barcode) and a direct link to a QR code served via HTTPS by the Google Chart API

    options is an object containing name which is the name of your app that will show up when the user scans the QR code and account which can be the username and will also show up in the user's app. Both parameters are optional


    returns an object containing a 6-character token

    verifyToken(secret, token, window)

    checks if a time-based token matches a token from secret key within a +/- window (default: 4) minute window

    returns either null if the token does not match, or an object containing delta key, which is an integer of how for behind / forward the code time sync is in terms of how many new codes have been generated since entry

    ex. {delta: -1} means that the client entered the key too late (a newer key was meant to be used). {delta: 1} means the client entered the key too early (an older key was meant to be used). {delta: 0} means the client was within the time frame of the current key.

    n-Minute Window

    The window is set to 4 by default. Each token is valid for a total of n minutes to account for time drift.


    npm i node-2fa

    DownloadsWeekly Downloads






    Unpacked Size

    18.8 kB

    Total Files


    Last publish


    • avatar