oathtool

oathtool [--totp[=alg]|--hotp] [--base32] [--digits num] [--counter num] [options] secret [otp]

oathtool generates and validates one-time passwords for two-factor authentication. It supports both HOTP (RFC 4226, counter-based) and TOTP (RFC 6238, time-based) algorithms.TOTP is the standard used by authenticator apps (Google Authenticator, Authy, etc.). The secret key is typically provided as a base32 string during 2FA setup. Running oathtool with this secret generates the same codes as the authenticator app.For validation, provide both the secret and the code to verify. The window option allows for clock skew by accepting codes from adjacent time periods.HOTP uses an incrementing counter instead of time. Each code generation should increment the counter. This mode is less common but useful for hardware tokens.Different services use different parameters - some require 8 digits or SHA256. The verbose flag shows the calculation details for debugging setup issues.

--totp[=ALG]

Generate time-based OTP (sha1, sha256, sha512).

Generate counter-based OTP.

Secret is base32 encoded.

Number of digits (default: 6).

Counter value for HOTP.

Time step in seconds (default: 30).

Start time for TOTP (Unix timestamp or ISO).

Use specified time instead of current.

Window for validation.

Show detailed output.

Secrets must be kept secure - anyone with the secret can generate codes. System time must be accurate for TOTP. No built-in secret storage - integrate with password managers. Command history may expose secrets - use environment variables or files for scripting.

oathtool is part of the OATH Toolkit project, implementing the Initiative for Open Authentication (OATH) standards. It was developed to provide open-source HOTP and TOTP implementations. The toolkit also includes PAM modules for system authentication and a library for developers.

pass-otp(1), 2fa(1), gpg(1), openssl(1)