Time-based One-time Password Generator (top-g)

This is a simple time-based one-time password generator. It works compatible with Google Autheticator and can import otpauth-migration://offline?data=... urls generated by Google Autheticator.

Installation

top-g is tested with python 3.10 but it should work all python 3 versions.Requirement packages can be installed in two ways:

1. With pip:

   pip install -r requirements.txt

2. With pipenv:

   pipenv install (Recommended)

Usage

It is needed to first import some keys from Google Authenticator app. It is done by the URLs that Google Authenticator creates. The URLs can be easily be created by exporting keys from the settings menu of Google Authenticator. Google Autheticator creates QR codes which contain the URLs. The URLs start with otpauth-migration://offline?data=.... These URLs can then be imported using following command:

python main.py --url <URL>

New keys can also be added but currently I don't need it and I haven't implemented yet.

top-g saves all keys in a binary file using Google's protobuf. The default file is ./payload.db. It can be changed by providing --db parameter to main.py as following:

python main.py --db <FILE> --url <URL>

After the first run with --url parameter, top-g saves the imported keys to database file. Then top-g can be run without --url parameter. If you run top-g later with again --url parameter, the keys in that URL will be added to the database file.

NOTE: The database file is not encrypted. Take your own risk.

Thanks

I want to thank you to Dimitri Sokolyuk for his Google Authenticator migration decoder and Patrice Ferlet and Tom Jaskowski for their answers under this stackoverflow page.

References

1. TOTP: Time-Based One-Time Password Algorithm: https://www.rfc-editor.org/rfc/rfc6238
2. HOTP: An HMAC-Based One-Time Password Algorithm: https://www.rfc-editor.org/rfc/rfc4226