This repository holds a combination of tools that can be used to (comfortably) generate TOTP 2FA access tokens on the desktop, instead of depending on a phone app.

Main tool, depends on:

• jq
• fzf
• OATH Toolkit
• wl-clipboard (optional)

It will use the cbc-file executable from this project to decrypt a ~/.local/share/otp_accounts file, whose decrypted contents should be in the same format as exported by andOTP. It can then run a menu, using fzf, to let you choose the account for which you want an access token. If running on Wayland, the token will also be copied to the clipboard.

$ get-otp [account_name]

This tool doesn't depend on anything besides cbc-file. What it does is encrypt the file passed to it (which should be in the format exported by andOTP, as mentioned above) and put the encrypted file in the correct place.

$ encrypt-otp otp_accounts.json

Mostly hidden utility, does the encryption magic. Despite the name, uses ChaCha20 Poly1305 for encryption, as implemented by BearSSL, together with argon2 for key derivation.

Both of the mentioned libraries are necessary for building this utility. On Linux, a kernel which implements the getrandom(2) syscall is necessary, since it is the backend for getentropy(3), which is the only random number backend implemented.

This is experimental code and ideas, and shouldn't be put anywhere near any sort of production. However, I am open to suggestions and improvements, so feel free to reach out.