Skip to content
BranchesTags

Repository files navigation

OtpSharper

State-of-the-art TOTP/HOTP library for .NET 10.

Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.

Install :

dotnet add package OtpSharper

Optional add-on packages:

dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet

Table of Contents

Features

FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)

Installation

dotnet add package OtpSharper

Optional add-ons:

dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore

Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.

Quick Start

New User Enrollment (simplest path)

usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);

Enrol from an Existing Secret

varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");

TOTP

Fluent Builder

varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);

Built-in Presets

TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1

Debug Window

// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");

HOTP (Counter-Based)

usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");

Custom Counter Store (Database Example)

publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}

Steam Guard

usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;

otpauth:// URI

usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();

Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.

QR Code Generation

usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">

All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).

Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.

Out-of-Band (SMS / Email) Codes

Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.

usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}

ASP.NET Core Identity Integration

The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.

dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});

Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.

Clock Drift Correction

usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();

Dependency Injection

// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}

Distributed Storage (Redis)

The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).

dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.

All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.

Security & Hardening

Constant-Time Comparison

Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.

varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};

Pinned Secret Memory

OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:

usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits

Secret Strength Enforcement

// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);

Brute-Force Backoff

Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.

varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}

Algorithm Recommendations

Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3

Project Structure

OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks

Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.

Running the Benchmarks

cd OtpSharper.Benchmark
dotnet run -c Release

Results: Secret Key Setup

These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.

MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more

Benchmark Interpretation

Setup_And_Generate — ~1.94x faster, ~1.30x less memory

This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.

Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory

Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.

Setup_ObjectCreation — 2.53x slower, 1.14x more memory

When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).

In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.

Testing

Tests use xUnit and FluentAssertions.

cd tests/OtpSharper.Tests
dotnet test

Test coverage includes:

  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip

Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:

docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test

Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.

Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.

RFC Compliance

RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full

License

MIT — see LICENSE for details.

Copyright © 2026 neo-vortex

About

.NET lib to geenrate TOTP AND HOTP fast and secure

Topics

csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes

Resources

Readme
MIT license
Activity

Stars

3 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
GitHub - Neo-vortex/OtpSharper: .NET lib to geenrate TOTP AND HOTP fast and secure · GitHub
Skip to content
BranchesTags
Repository files navigation
OtpSharper
State-of-the-art TOTP/HOTP library for .NET 10.
Full RFC 6238 (TOTP) and RFC 4226 (HOTP) compliance, Steam Guard support, multiple HMAC algorithms, configurable validation windows, NTP drift correction, otpauth:// URI support with local QR code rendering, out-of-band (SMS/email) codes, brute-force backoff protection, ASP.NET Core Identity integration, optional Redis-backed distributed storage, and a rich fluent API — built for correctness, performance, and security.
Install :
dotnet add package OtpSharper 
Optional add-on packages:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed distributed stores

.NETLicense: MITNuGet
Table of Contents
Features
FeatureDetails
TOTPRFC 6238 compliant — 30s/60s/custom steps
HOTPRFC 4226 compliant — stateful counter store
Steam GuardValve's custom 5-char TOTP variant
AlgorithmsHMAC-SHA1, SHA256, SHA384, SHA512, SHA3-256, SHA3-512
DigitsConfigurable 1–10 digits
WindowsAsymmetric look-ahead / look-behind validation windows
EpochCustom T0 epoch (RFC 6238 §4)
Clock syncNTP drift measurement + corrected time provider
URIotpauth:// build, parse
QR codesLocal PNG / SVG / data-URI rendering — no external service
Out-of-band codesRandom, hashed, single-use codes for SMS/email delivery
ASP.NET Core IdentityDrop-in IUserTwoFactorTokenProvider (separate package)
DIIServiceCollection extension methods
SecurityConstant-time comparison, pinned + zeroed secret memory
BackoffThread-safe brute-force lockout with configurable policy
Secret strengthEntropy estimation and minimum-strength enforcement
Distributed storageRedis-backed out-of-band code store (separate package)
Installation
dotnet add package OtpSharper
Optional add-ons:
dotnet add package OtpSharper.AspNetCore.Identity # ASP.NET Core Identity two-factor provider
dotnet add package OtpSharper.Redis # Redis-backed IOobCodeStore
Requirements: .NET 10.0+. OtpSharper itself now also pulls in QRCoder for local QR rendering. OtpSharper.AspNetCore.Identity additionally requires Microsoft.Extensions.Identity.Core; OtpSharper.Redis requires StackExchange.Redis.
Quick Start
New User Enrollment (simplest path)
usingOtpSharper;// Generate a new secret and configure TOTP for a uservarmanager=OtpManager.Create("alice@example.com",issuer:"MyApp");
# Presentto the user for scanning
Console.WriteLine(manager.GetOtpAuthUri());// otpauth://totp/...Console.WriteLine(manager.GetSetupKey());// JBSWY3DPEHPK3PXP (Base32)byte[]qrPng=manager.GetQrCodePng();// render locally, no external service// Generate the current codevarcode=manager.Generate();Console.WriteLine($"{code.Code} (expires in {code.RemainingSeconds}s)");// Validate user inputboolvalid=manager.Validate(userInput);
Enrol from an Existing Secret
varsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");varoptions=TotpOptions.GoogleAuthenticator;// SHA1, 30s, 6 digits, ±1 windowvartotp=newTotpGenerator(secret,options);OtpCodecode=totp.Generate();varresult=totp.Validate(userInput);if(result.IsValid)Console.WriteLine($"Matched at window offset {result.WindowOffset}");
TOTP
Fluent Builder
varoptions=newTotpOptionsBuilder().WithAlgorithm(OtpAlgorithm.HmacSha256).WithStepSeconds(30).WithDigits(8).WithValidationWindow(1)// ±1 step (3 codes accepted).WithExtraLookBehind(1)// 2 steps behind total.Build();vartotp=newTotpGenerator(secret,options);
Built-in Presets
TotpOptions.Default// SHA1, 30s, 6 digits, ±1TotpOptions.GoogleAuthenticator // Same as Default
TotpOptions.HighSecurity // SHA256, 30s, 8 digits, strict (0 window)
TotpOptions.MaxSecurity // SHA512, 30s, 8 digits, strict
TotpOptions.SixtySeconds // SHA1, 60s, 6 digits, ±1
Debug Window
// Inspect all codes in the validation window — useful for diagnosing clock driftvarwindow=totp.GenerateWindow();foreach(var(offset,code)inwindow)Console.WriteLine($"Offset {offset,+3}: {code.Code}");
HOTP (Counter-Based)
usingOtpSharper.Hotp;varstore=newInMemoryHotpCounterStore();varhotp=newHotpGenerator(secret);// Generate at a specific counterOtpCodecode=hotp.GenerateAt(counter:0);// "755224" (RFC 4226 vector)// Validate + auto-advance counter in storevarresult=awaithotp.ValidateAsync("755224",keyId:"user1",store);if(result.IsValid)Console.WriteLine($"Matched counter {result.MatchedCounter}, offset {result.WindowOffset}");
Custom Counter Store (Database Example)
publicclassDbHotpCounterStore:IHotpCounterStore{privatereadonlyMyDbContext_db;publicasyncValueTask<long>GetCounterAsync(stringkeyId,CancellationTokenct)=>(await_db.OtpCounters.FindAsync([keyId],ct))?.Counter??0;publicasyncValueTaskSetCounterAsync(stringkeyId,longnewCounter,CancellationTokenct){varrow=await_db.OtpCounters.FindAsync([keyId],ct);if(rowisnull)_db.OtpCounters.Add(newOtpCounter{KeyId=keyId,Counter=newCounter});elseif(newCounter>row.Counter)row.Counter=newCounter;await_db.SaveChangesAsync(ct);}}
Steam Guard
usingOtpSharper.Steam;varsteam=newSteamGuardGenerator(secret);SteamGuardCodecode=steam.Generate();Console.WriteLine(code.Code);// e.g. "X3Y2K"boolvalid=steam.Validate(userInput).IsValid;
otpauth:// URI
usingOtpSharper.Uri;// Buildvaruri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");stringstr=uri.ToUriString();// => otpauth://totp/MyApp:alice%40example.com?secret=...&issuer=MyApp// Parsevarparsed=OtpUri.Parse("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example");TotpGeneratortotp=parsed.ToTotpGenerator();
Note: OtpSharper is the only .NET OTP library in this benchmark comparison that includes a built-in otpauth:// URI parser.
QR Code Generation
usingOtpSharper.Uri;varuri=OtpUri.ForTotp("alice@example.com",secret,options,issuer:"MyApp");byte[]png=uri.ToQrCodePng(pixelsPerModule:10);// raw PNG bytesstringsvg=uri.ToQrCodeSvg(pixelsPerModule:10);// inline SVG markupstringdataUri=uri.ToQrCodeDataUri();// "data:image/png;base64,..." for <img src="...">
All three render entirely locally via QRCoder — no network call, and the secret-bearing otpauth:// URI never leaves the process. OtpManager exposes matching convenience methods (GetQrCodePng, GetQrCodeSvg, GetQrCodeDataUri).
Migrating from ToQrCodeImageUrl() / GetQrCodeUrl(): both are marked [Obsolete]. They built a URL against the Google Charts Image API, which was shut down in 2019 — the URL no longer renders an image. Switch to the methods above.
Out-of-Band (SMS / Email) Codes
Unlike TOTP/HOTP, out-of-band codes aren't derived from a shared secret — there's nothing for the server to compute and compare. Instead the server generates a random code, remembers only its SHA-256 hash (with a TTL and attempt limit) via IOobCodeStore, and hands you the plaintext once so you can send it through SMS or email. Validation consumes the code — one-time use, unlike a TOTP code which stays valid for its whole window.
usingOtpSharper.OutOfBand;varstore=newInMemoryOobCodeStore();// or RedisOobCodeStore — see Distributed Storagevargenerator=newOobCodeGenerator(store,newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5),MaxAttempts=5,});stringcode=awaitgenerator.GenerateAsync("phone:+15551234567");// hand `code` to your SMS provider — it is not retrievable againvarresult=awaitgenerator.ValidateAsync("phone:+15551234567",userInput);if(result.IsValid){// proceed — the code has already been consumed and cannot be reused}
ASP.NET Core Identity Integration
The OtpSharper.AspNetCore.Identity package provides an IUserTwoFactorTokenProvider<TUser> that plugs into Identity's existing enrollment flow (GenerateNewAuthenticatorKey / ResetAuthenticatorKeyAsync) — only the token provider registration changes. It adds configurable HMAC algorithm/digits and optional replay protection on top of what Identity's built-in AuthenticatorTokenProvider offers.
dotnet add package OtpSharper.AspNetCore.Identity
usingOtpSharper.AspNetCore.Identity;services.AddIdentity<ApplicationUser,IdentityRole>().AddEntityFrameworkStores<AppDbContext>().AddOtpSharperTwoFactorTokenProvider<ApplicationUser>(options =>{options.TotpOptions=TotpOptions.GoogleAuthenticator;// default; matches existing authenticator-app enrollmentsoptions.ReplayTracker=newUsedCodeTracker();// optional: reject an intercepted code replayed within the window});
Call UserManager.GenerateTwoFactorTokenAsync(user, "OtpSharper") / VerifyTwoFactorTokenAsync(user, "OtpSharper", code) as usual, or pass tokenProviderName: "Authenticator" to AddOtpSharperTwoFactorTokenProvider to swap it in as a transparent replacement for Identity's built-in provider without changing any calling code.
Clock Drift Correction
usingOtpSharper.Sync;// Measure drift vs NTPClockDriftResultdrift=awaitClockSync.MeasureDriftAsync("pool.ntp.org");Console.WriteLine(drift);// "Drift: +234.5ms vs pool.ntp.org at 2025-01-01T..."if(drift.IsProblematic){ITimeProvidercorrected=drift.CreateCorrectedTimeProvider();varoptions=newTotpOptions{TimeProvider=corrected};vartotp=newTotpGenerator(secret,options);}// Or auto-create in one callITimeProviderprovider=awaitClockSync.CreateCorrectedTimeProviderAsync();
Dependency Injection
// Program.cs / Startup.csservices.AddTotp("JBSWY3DPEHPK3PXP", options =>options.WithAlgorithm(OtpAlgorithm.HmacSha256).WithDigits(8));// Or from a full otpauth:// URIservices.AddOtpManager("otpauth://totp/App:user@example.com?secret=...");// Out-of-band (SMS/email) codes — in-memory store by defaultservices.AddOobCodeGenerator(newOobCodeOptions{Digits=6,Ttl=TimeSpan.FromMinutes(5)});// InjectpublicclassAuthService(TotpGeneratortotp){publicboolVerify(stringcode)=>totp.Validate(code).IsValid;}
Distributed Storage (Redis)
The default InMemoryOobCodeStore, InMemoryHotpCounterStore, and UsedCodeTracker are all per-process — fine for a single instance, not shared across a multi-instance deployment. The OtpSharper.Redis package provides Redis-backed implementations of all three: IOobCodeStore, IHotpCounterStore, and IUsedCodeStore (a new interface UsedCodeTracker now implements, so it's swappable without touching calling code).
dotnet add package OtpSharper.Redis
usingOtpSharper.Redis;usingStackExchange.Redis;services.AddSingleton<IConnectionMultiplexer>(_ =>ConnectionMultiplexer.Connect("localhost:6379"));services.AddRedisOobCodeStore();// registers IOobCodeStore backed by Redisservices.AddOobCodeGenerator();// picks up the Redis store instead of the in-memory defaultservices.AddRedisHotpCounterStore();// registers IHotpCounterStore backed by Redisservices.AddRedisUsedCodeStore();// registers IUsedCodeStore backed by Redis, for replay// protection in OtpSharperTotpOptions.ReplayTracker// (OtpSharper.AspNetCore.Identity) or your own code
  • RedisOobCodeStore — each pending code is a Redis hash with a native EXPIRE matching its TTL, so Redis evicts stale entries on its own even if RemoveAsync is never called.
  • RedisHotpCounterStore — SetCounterAsync's "only advance, never regress" contract is enforced with a small Lua script evaluated server-side, so the read-compare-write is atomic even with multiple instances racing to advance the same counter.
  • RedisUsedCodeStore — marks a (keyId, counter) pair used via SET ... NX EX, an atomic "first use" check with a built-in expiry, in one round trip.
All three are covered by integration tests in tests/OtpSharper.Redis.Tests — they run against a real Redis instance (docker run --rm -p 6379:6379 redis, or set OTPSHARPER_TEST_REDIS) and no-op if none is reachable, rather than mocking StackExchange.Redis's surface.
Security & Hardening
Constant-Time Comparison
Enabled by default to prevent timing oracle attacks. The validator always compares the full code string before returning, regardless of the position of the first differing character.
varoptions=newTotpOptions{UseConstantTimeComparison=true// default — do not disable in production};
Pinned Secret Memory
OtpSecret allocates a GC-pinned array and zeroes it on Dispose(). Always use using:
usingvarsecret=OtpSecret.FromBase32("JBSWY3DPEHPK3PXP");// secret bytes are zeroed when the using block exits
Secret Strength Enforcement
// Estimate entropydoublebits=OtpSecretGenerator.EstimateEntropyBits(base32Secret);// ClassifySecretStrengthstrength=OtpSecretGenerator.AssessStrength(base32Secret);// Weak (≤80 bits) | Adequate (81–127) | Strong (128–255) | VeryStrong (256+)// Enforce a minimum — throws CryptographicException if not metOtpSecretGenerator.EnsureMinimumStrength(base32Secret,minimumBits:128);// Generate a correctly-sized secret for an algorithmOtpSecretsecret=OtpSecretGenerator.GenerateForAlgorithm(OtpAlgorithm.HmacSha256);
Brute-Force Backoff
Thread-safe in-memory lockout policy. OtpSharper.Redis doesn't cover OtpBackoffPolicy yet (it does cover HOTP counters and replay tracking — see Distributed Storage); for distributed lockout today, replicate the same logic against a shared cache yourself.
varpolicy=newOtpBackoffPolicy(newOtpBackoffOptions{MaxFailedAttempts=5,LockoutDuration=TimeSpan.FromMinutes(15),AttemptWindow=TimeSpan.FromMinutes(10),ResetOnSuccess=true,});// Check before validatingBackoffResultcheck=policy.CheckAllowed(userId);if(!check.IsAllowed){Console.WriteLine($"Locked out until {check.LockoutExpiry}");return;}boolvalid=totp.Validate(userCode).IsValid;if(valid)policy.RecordSuccess(userId);else{varresult=policy.RecordFailure(userId);Console.WriteLine($"{result.RemainingAttempts} attempts remaining");}
Algorithm Recommendations
Use CaseRecommended AlgorithmReason
Google Authenticator compatibilitySHA1RFC-mandated; universal support
New systems / higher securitySHA256Stronger, still widely supported
Maximum securitySHA512 or SHA3-512Future-proof; OtpSharper exclusive for SHA3
Project Structure
OtpSharper/
├── src/
│ ├── OtpSharper/
│ │ ├── Abstractions/
│ │ │ ├── OtpBackoffPolicy.cs # Brute-force lockout
│ │ │ ├── TotpValidationService.cs # High-level validation service
│ │ │ └── UsedCodeTracker.cs # Replay prevention tracker
│ │ ├── Algorithms/
│ │ │ ├── HmacProvider.cs # HMAC-SHA1/256/384/512/SHA3 computation
│ │ │ └── OtpAlgorithm.cs # Algorithm enum
│ │ ├── Core/
│ │ │ ├── Base32.cs # RFC 4648 Base32 codec
│ │ │ ├── DynamicTruncation.cs # RFC 4226 §5.3 truncation + constant-time compare
│ │ │ ├── OtpResults.cs # OtpCode / OtpValidationResult types
│ │ │ ├── OtpSecret.cs # Pinned, zeroed secret container
│ │ │ ├── OtpSecretGenerator.cs # Key generation + entropy assessment
│ │ │ └── TimeProvider.cs # Abstracted time source
│ │ ├── Extensions/
│ │ │ └── ServiceCollectionExtensions.cs # DI registration helpers
│ │ ├── Hotp/
│ │ │ ├── HotpCounterStore.cs # IHotpCounterStore + in-memory impl
│ │ │ ├── HotpGenerator.cs # RFC 4226 HOTP generator + validator
│ │ │ └── HotpOptions.cs # HOTP configuration
│ │ ├── OutOfBand/
│ │ │ ├── IOobCodeStore.cs # IOobCodeStore + in-memory impl
│ │ │ ├── OobCodeGenerator.cs # Random hashed single-use SMS/email codes
│ │ │ └── OobCodeOptions.cs # Digits / TTL / attempt-limit configuration
│ │ ├── Steam/
│ │ │ └── SteamGuardGenerator.cs # Steam Guard 5-char TOTP variant
│ │ ├── Sync/
│ │ │ └── ClockSync.cs # NTP drift measurement + correction
│ │ ├── Totp/
│ │ │ ├── TotpGenerator.cs # RFC 6238 TOTP generator + validator
│ │ │ ├── TotpOptions.cs # TOTP configuration + presets
│ │ │ └── TotpOptionsBuilder.cs # Fluent options builder
│ │ ├── Uri/
│ │ │ ├── OtpUri.cs # otpauth:// builder, parser
│ │ │ └── OtpQrCode.cs # Local PNG / SVG / data-URI QR rendering
│ │ ├── GlobalUsings.cs
│ │ ├── OtpManager.cs # High-level enrollment + validation facade
│ │ └── OtpSharper.csproj
│ ├── OtpSharper.AspNetCore.Identity/
│ │ ├── IdentityBuilderExtensions.cs # AddOtpSharperTwoFactorTokenProvider<TUser>
│ │ ├── OtpSharperTotpOptions.cs # Algorithm/digits/replay-tracker configuration
│ │ ├── OtpSharperTotpTokenProvider.cs # IUserTwoFactorTokenProvider<TUser> implementation
│ │ └── OtpSharper.AspNetCore.Identity.csproj
│ └── OtpSharper.Redis/
│ ├── RedisOobCodeStore.cs # IOobCodeStore backed by Redis hashes + native TTL
│ ├── ServiceCollectionExtensions.cs # AddRedisOobCodeStore
│ └── OtpSharper.Redis.csproj
├── tests/
│ ├── OtpSharper.Tests/
│ │ ├── AbstractionTests.cs # Backoff policy, used-code store tests
│ │ ├── Base32AndUriTests.cs # Base32 codec + URI round-trip tests
│ │ ├── HotpTests.cs # RFC 4226 test vectors
│ │ ├── OtpQrCodeTests.cs # Local PNG/SVG/data-URI QR rendering tests
│ │ ├── OutOfBandTests.cs # OOB code generator + in-memory store tests
│ │ ├── SteamGuardTests.cs # Steam Guard output tests
│ │ ├── TotpTests.cs # RFC 6238 test vectors + window tests
│ │ └── OtpSharper.Tests.csproj
│ └── OtpSharper.Redis.Tests/
│ ├── RedisFixture.cs # Shared connection + availability check
│ ├── RedisOobCodeStoreTests.cs # Integration tests against a real Redis instance
│ ├── RedisHotpCounterStoreTests.cs # Including a concurrent-advance race test
│ ├── RedisUsedCodeStoreTests.cs # Including a concurrent-first-use race test
│ └── OtpSharper.Redis.Tests.csproj
├── OtpSharper.Benchmark/
│ ├── AlgorithmBenchmarks.cs # Per-algorithm TOTP throughput
│ ├── Base32Benchmarks.cs # Base32 encode/decode at various key sizes
│ ├── HotpGenerationBenchmarks.cs # HOTP generation at various counters
│ ├── OtpUriBenchmarks.cs # URI parse + round-trip
│ ├── SecretKeySetupBenchmarks.cs # Full cold-path setup + generate
│ ├── TotpGenerationBenchmarks.cs # Steady-state TOTP generation
│ ├── TotpValidationBenchmarks.cs # Server-side validation hot path
│ ├── Program.cs
│ └── OtpSharper.Benchmark.csproj
├── OtpSharper.sln
└── LICENSE

Benchmarks
Benchmarks compare OtpSharper against Otp.NET (v1.4.1), the most widely-used .NET OTP library. All tests run on .NET 10.0 using BenchmarkDotNet 0.15.8 in Release mode with JIT optimizations enforced.
Running the Benchmarks
cd OtpSharper.Benchmark
dotnet run -c Release
Results: Secret Key Setup
These benchmarks measure the cold path — relevant for stateless APIs that construct the TOTP object on every request rather than caching it.
MethodCategoriesMeanErrorStdDevRatioRatioSDAllocatedAlloc Ratio
Otp.NETSetup_And_Generate2,933.23 ns40.393 ns35.808 nsbaseline960 B
OtpSharperSetup_And_Generate1,510.06 ns14.997 ns12.523 ns1.94x faster0.03x736 B1.30x less
Otp.NETSetup_FromBase32_Generate3,233.58 ns27.413 ns22.891 nsbaseline1008 B
OtpSharperSetup_FromBase32_Generate1,687.82 ns22.657 ns20.085 ns1.92x faster0.03x784 B1.29x less
Otp.NETSetup_ObjectCreation61.45 ns1.529 ns1.277 nsbaseline168 B
OtpSharperSetup_ObjectCreation155.67 ns6.084 ns5.080 ns2.53x slower0.09x192 B1.14x more
Benchmark Interpretation
Setup_And_Generate — ~1.94x faster, ~1.30x less memory
This scenario constructs the TOTP object and computes a code in one shot, simulating a stateless server that doesn't cache generator instances (a common pattern in microservices and serverless functions). OtpSharper is nearly twice as fast here. In a system processing thousands of 2FA verifications per second, this directly translates to throughput.
Setup_FromBase32_Generate — ~1.92x faster, ~1.29x less memory
Same as above but starting from a Base32-encoded secret string — the realistic path when a stored secret is read from a database and decoded before use. OtpSharper's combined Base32 decode + HMAC compute pipeline is more efficient than Otp.NET's equivalent. Memory savings (~220 bytes per call) also reduce GC pressure in high-throughput scenarios.
Setup_ObjectCreation — 2.53x slower, 1.14x more memory
When creating a generator object alone (with no code generation), OtpSharper is slower. This is an intentional trade-off: OtpSecret performs GC pinning at construction time to protect key material from being moved or scanned in memory. This extra work during object creation pays a small upfront cost that enables the secure zeroing-on-dispose behaviour. For any scenario that actually generates or validates a code — which is every real-world use — the pinning overhead is amortised and OtpSharper wins overall (see the two rows above).
In short: OtpSharper is faster where it matters (end-to-end operations) and slower only in the micro-benchmark that isolates pure object allocation — a scenario that never occurs in isolation in production.
Testing
Tests use xUnit and FluentAssertions.
cd tests/OtpSharper.Tests
dotnet test
Test coverage includes:
  • RFC 4226 test vectors — all 10 HOTP reference values from Appendix D
  • RFC 6238 test vectors — all 18 TOTP reference values from Appendix B (SHA1, SHA256, SHA512)
  • Validation window — look-ahead, look-behind, and asymmetric window tests
  • Base32 codec — encode/decode round-trips, padding, error cases
  • otpauth:// URI — parse, build, and round-trip for TOTP and HOTP URIs
  • Steam Guard — expected output for known inputs
  • Backoff policy — lockout triggering, expiry, reset on success, concurrent access
  • Used-code / replay tracking — first-use vs. replay, via the IUsedCodeStore interface
  • Out-of-band codes — generation, validation, expiry, attempt-limit lockout, one-time use
  • Local QR rendering — PNG signature validity, SVG markup, data-URI round-trip
Redis-backed stores (OtpSharper.Redis) have their own integration test project, tests/OtpSharper.Redis.Tests, run separately since they need a real Redis instance:
docker run --rm -p 6379:6379 redis # or set OTPSHARPER_TEST_REDIS to point elsewherecd tests/OtpSharper.Redis.Tests
dotnet test
Tests in that project no-op (rather than fail) if no Redis is reachable, so dotnet test on the whole solution still passes without one — see RedisFixture for the connectivity check. They cover round-tripping each store plus the concurrency guarantees that motivate using Redis in the first place: RedisHotpCounterStoreTests.ConcurrentAdvances_NeverRegress and RedisUsedCodeStoreTests.ConcurrentFirstUse_OnlyOneWinner both fire many simultaneous calls at the same key and assert the atomic Lua-script / SET NX EX behaviour holds up.
Not yet covered:OtpSharper.AspNetCore.Identity's OtpSharperTotpTokenProvider has no tests yet — it needs a UserManager<TUser> test harness (a fake IUserStore/IUserAuthenticatorKeyStore, or Microsoft.AspNetCore.Identity.EntityFrameworkCore with an in-memory provider) that's more setup than the rest of this session's scope covered. Treat that package as the one part of this PR still worth reviewing carefully before merging.
RFC Compliance
RFCSectionStatus
RFC 4226§4 Algorithm✅ Full
RFC 4226§5 Dynamic Truncation✅ Full
RFC 4226Appendix D test vectors✅ All 10 pass
RFC 6238§4 TOTP Algorithm✅ Full
RFC 6238§5 Security✅ (constant-time, window)
RFC 6238Appendix B test vectors✅ All 18 pass
RFC 4648Base32 encoding✅ Full
Google Auth Key URIotpauth:// format✅ Full
License
MIT — see LICENSE for details.
Copyright © 2026 neo-vortex
About
.NET lib to geenrate TOTP AND HOTP fast and secure
Topics
csharpdotnethmachotphotp-generatorotpotp-generatorotp-verificationtotptotp-codes
Resources
Readme
MIT license
Activity
Stars
3 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Used by
Contributors
Languages