A lightweight Kotlin Multiplatform library for generating TOTP & HOTP one-time passwords.

RFC-compliant TOTP (RFC 6238) and HOTP (RFC 4226) implementation supporting SHA-1, SHA-256, and SHA-512. Zero third-party dependencies — uses only platform-native cryptography.

kotlin {
    sourceSets {
        commonMain.dependencies {
            implementation("io.github.elliuqahs:beauthy-sdk:0.1.0")
        }
    }
}

dependencies {
    implementation("io.github.elliuqahs:beauthy-sdk-android:0.1.0")
}

import com.maoungedev.beauthy.core.crypto.*

val generator = TotpGenerator(JvmHmacProvider())

// TOTP (SHA-1, 6 digits, 30s)
val code = generator.generate(secret = "JBSWY3DPEHPK3PXP", timestampMillis = System.currentTimeMillis())
val remaining = generator.remainingSeconds(System.currentTimeMillis())

// TOTP with SHA-256
val code256 = generator.generate(
    secret = "JBSWY3DPEHPK3PXP",
    timestampMillis = System.currentTimeMillis(),
    algorithm = HmacAlgorithm.SHA256
)

// HOTP
val hotp = generator.generateHotp(secret = "JBSWY3DPEHPK3PXP", counter = 42)

// Validate Base32
if (Base32.isValid(userInput)) {
    val bytes = Base32.decode(userInput)
}

import com.maoungedev.beauthy.core.crypto.*

val generator = TotpGenerator(IosHmacProvider())

// Same API as Android
val code = generator.generate(secret = "JBSWY3DPEHPK3PXP", timestampMillis = getCurrentTimeMillis())
val remaining = generator.remainingSeconds(getCurrentTimeMillis())

The only difference is the HmacProvider — use JvmHmacProvider() on Android and IosHmacProvider() on iOS. All other APIs are identical.

Support it by joining stargazers for this repository. ⭐

Copyright 2025 Beauthy

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.