{"id":18269651,"url":"https://github.com/reedobrien/goathtool","last_synced_at":"2025-08-01T13:34:01.708Z","repository":{"id":26349389,"uuid":"29798301","full_name":"reedobrien/goathtool","owner":"reedobrien","description":"A CLI OTP generator","archived":false,"fork":false,"pushed_at":"2022-02-14T23:05:04.000Z","size":16,"stargazers_count":22,"open_issues_count":1,"forks_count":4,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-07-22T17:47:58.546Z","etag":null,"topics":["cli","go","oathtool","otp","totp"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/reedobrien.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-01-25T01:22:15.000Z","updated_at":"2025-07-02T07:09:12.000Z","dependencies_parsed_at":"2022-08-28T01:00:18.136Z","dependency_job_id":null,"html_url":"https://github.com/reedobrien/goathtool","commit_stats":null,"previous_names":["gophergala/goathtool"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/reedobrien/goathtool","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reedobrien%2Fgoathtool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reedobrien%2Fgoathtool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reedobrien%2Fgoathtool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reedobrien%2Fgoathtool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reedobrien","download_url":"https://codeload.github.com/reedobrien/goathtool/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reedobrien%2Fgoathtool/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268231415,"owners_count":24217032,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-01T02:00:08.611Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","go","oathtool","otp","totp"],"created_at":"2024-11-05T11:36:45.818Z","updated_at":"2025-08-01T13:34:01.646Z","avatar_url":"https://github.com/reedobrien.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# goathtool README\n\n## Synopsis\n\ngoathtool attempts reproduces the functionality of nongnu.org's oathtool\n\u003chttp://www.nongnu.org/oath-toolkit/man-oathtool.html\u003e. How incompletely is to\nbe determined. The intent is to implement the functionality the primary author\nuses most and then -- as time or PRs occur -- to fill in more of the features.\nThe author also intends to differ in implementation of defaults and invocation.\n\ngoathtool will only implement the short flags as the author intends to forgo 3rd\nparty libraries.\n\n## Description\n\ngoathtool\n\nGenerate OATH one-time passwords (OTP).\n\n\n## Examples\n\nThe following examples are borrowed/stolen from the oathtool man page and are\ntherefore: Copyright © 2013 Simon Josefsson. License GPLv3+: GNU GPL version 3\nor later \u003chttp://gnu.org/licenses/gpl.html\u003e.\n\nThe commands have been modified to use the syntax goathtool uses.\n\nTo generate the first event-based (HOTP) one-time password for an all-zero key:\n\n    $ goathtool hotp 00\n    328482\n    $\n\nSometime you want to generate more than a single OTP.  To generate 10\nadditional event-based one-time pass‐ words, with the secret key used in the\nexamples of RFC 4226, use the -w (--window) parameter:\n\n    $ goathtool hotp -w 10 3132333435363738393031323334353637383930\n    755224\n    287082\n    359152\n    969429\n    338314\n    254676\n    287922\n    162583\n    399871\n    520489\n    403154\n    $\n\nIn the last output, the counter for the first OTP was 0, the second OTP had a\ncounter of 1, and so on up to 10.\n\nIn order to use keys encoded in Base32 instead of hex, you may provide the -b (--base32) parameter:\n\n    $ goathtool hotp -b -w 3 GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ\n    755224\n    287082\n    359152\n    969429\n    $\n\nThe tool ignore whitespace in base32 data and re-add padding if necessary, thus\nyou may supply keys format‐ ted like the one below.\n\n    $ goathtool totp -b  \"gr6d 5br7 25s6 vnck v4vl hlao re\"\n    977872\n    $\n\n\nTo generate a particular OTP, use the -c (--counter) parameter to give the\nexact position directly:\n\n    $ goathtool hotp -c 5 3132333435363738393031323334353637383930\n    254676\n    $\n\nTo validate a HOTP one-time password supply the OTP last on the command line:\n\n  \t$ goathtool hotp -w 10 3132333435363738393031323334353637383930 969429\n  \t3\n  \t$\n\nThe output indicates the counter that was used.  It works by starting with\ncounter 0 and increment until it founds a match (or not), within the supplied\nwindow of 10 OTPs.\n\nThe  tool  supports  time-variant one-time passwords, in so called TOTP mode.\nUsage is similar, but --totp needs to be provided:\n\n    $ goathtool totp 00\n    943388\n    $\n\nDon't be alarmed if you do not get the same output, this is because the output\nis time variant.  To  gener‐ ate a TOTP for a particular fixed time use the -N\n(--now) parameter:\n\n    $ goathtool totp -N \"2008-04-23 17:42:17 UTC\" 00\n    974945\n    $\n\nThe  format is a mostly free format human readable date string such as \"Sun, 29\nFeb 2004 16:21:42 -0800\" or \"2004-02-29 16:21:42\" or even \"next Thursday\".  It\nis the same used as the --date parameter of the  date(1) tool.\n\nYou may generate several TOTPs by specifying the --window parameter, similar to\nhow it works for HOTP.  The OTPs generated here will be for the initial time\n(normally current time) and then each following time  step (e.g., 30 second\nwindow).\n\n    $ goathtool totp -w 5 00\n\t815120\n    003818\n    814756\n    184042\n    582326\n    733842\n    $\n\nYou  can  validate  a TOTP one-time password by supplying the secret and a\nwindow parameter (number of time steps before or after current time):\n\n    $ goathtool totp -w 5 00 `goathtool --totp 00`\n    0 # NB: this currently returns the counter not the item in the window that was found.\n    $\n\nSimilar when generating TOTPs, you can use a -N (--now) parameter to specify\nthe time to use instead of the current time:\n\n    $  goathtool totp -d 8 -N \"2005-03-18 01:58:29 UTC\" -w 10000000 3132333435363738393031323334353637383930 89005924\n    4115227 # NB: this also returns a different number also because it returns the counter not the window item that matched\n    $\n\nThe previous test uses values from the TOTP specification  and  will  stress\ntest  the  tool  because  the expected window is around 4 million time-steps.\n\nThere are two system parameters for TOTP: the time-step size and the time\nstart.\n\nBy default the time-step size is 30 seconds, which means you get a new OTP\nevery 30 seconds.  You may mod‐ ify this with the -s (--time-step-size)\nparameter:\n\n    $ goathtool totp -s 45 00\n    109841 # time based doesn't validate\n    $\n\nThe values are valid ISO-8601 durations, see:\nhttp://en.wikipedia.org/wiki/ISO_8601#Durations\n\nThe time start is normally 1970-01-01 00:00:00 UTC but you may change it using\nthe -S (--start-time):\n\n    $ goathtool totp -S \"1980-01-01 00:00:00 UTC\" 00\n    273884 # time based doesnt' validate\n    $\n\nTo get more information about what the tool is using use the -v (--verbose)\nparameter.  Finally, to  gener‐ ate the last TOTP (for SHA-1) in the test\nvector table of draft-mraihi-totp-timebased-07 you can invoke the tool like\nthis:\n\n    $ goathtool totp -v -N \"2033-05-18 03:33:20 UTC\" -d 8 3132333435363738393031323334353637383930\n    Hex secret: 3132333435363738393031323334353637383930\n    Base32 secret: GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ\n    Digits: 8\n    Window size: 0\n    Step size (seconds): 30\n    Start time: 1970-01-01 00:00:00 UTC (0)\n    Time now: 2033-05-18 03:33:20 UTC (2000000000)\n    Counter: 0x3F940AA (66666666)\n\n    69279037\n    $\n\nIn the last one the authoer only outputs either the hex or base32 secret that is provided.\n\n## To Do\n\n - [x] LICENSE\n - [x] COPYRIGHT\n - [x]  Flags - outline basic flags\n  \t- [x] common flags\n\t\t- [x] -b base32\n\t\t- [x] -d number of digits in the OTP\n\t\t- [x] -w window of counter values to test\n  \t- [x]  hotp flags\n\t\t- [x] -c counter\n  \t- [x]  totp flags\n \t\t- [x] -s time-step duration\n \t\t- [x] -N time to use as current time\n\t\t- [x] -S time to start counting steps from (epoch)\n - [x] subcommand switch (hotp, totp)\n - [x] implement hotp\n - [x] implement totp using hotp\n - [x] ignore whitespace\n - [x] autopad base32 strings\n - [ ] tests\n - [ ] examples\n - [ ] godoc\n - [ ] add relevant docs and installation to README\n - [ ] fix totp validation to return the item from the window that matched not the abused counter\n - [ ] don't abuse counter AKA refactor\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freedobrien%2Fgoathtool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freedobrien%2Fgoathtool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freedobrien%2Fgoathtool/lists"}