OTP_Verification_GUI

OTP Verification GUI

Description

A complete OTP (One-Time Password) verification system with GUI supporting both Time-Based OTP (TOTP) and Email/SMS OTP simulation. Perfect for learning authentication systems.

Features

• Time-Based OTP (TOTP) generation
• Auto-updating TOTP display
• Email/SMS OTP simulation
• 6-digit OTP codes
• Expiry timer (5 minutes for OTP, 30 seconds for TOTP)
• Visual countdown timer
• Color-coded validity indicator
• Verification system
• Clean, intuitive interface

Stack

• Language: Python
• Libraries:
  • pyotp==2.9.0 (OTP generation)
  • tkinter (standard library - GUI)
• Complexity: Intermediate

Installation

pip install -r requirements.txt
python main.py

OTP Types

1. Time-Based OTP (TOTP)

• Changes every 30 seconds
• Based on current time
• Used by Google Authenticator, Authy
• No need to send via email/SMS
• More secure

2. Email/SMS OTP

• 6-digit random code
• Valid for 5 minutes
• Sent to user's contact
• Traditional method
• Simulated in this app

How to Use

TOTP Verification

1. View current TOTP code (updates automatically)
2. Enter the code in verification field
3. Click "Verify TOTP"
4. See success/failure message

Email/SMS OTP

1. Enter phone number or email
2. Click "Generate OTP"
3. Note the OTP code (simulated)
4. Enter OTP in verification field
5. Click "Verify OTP"
6. See success/failure message

Features Explained

Auto-Updating TOTP

• Updates every second
• Shows remaining validity time
• Color changes based on time:
  • 🟢 Green: >10 seconds
  • 🟠 Orange: 5-10 seconds
  • 🔴 Red: <5 seconds

OTP Expiry

• TOTP: 30 seconds
• Email/SMS OTP: 5 minutes
• Automatic expiry checking
• Clear expiry notifications

Security Features

• Random OTP generation
• Time-based validation
• Expiry enforcement
• Single-use codes (in real implementation)

Technical Details

TOTP Algorithm

# Based on RFC 6238
totp = pyotp.TOTP(secret_key)
current_code = totp.now()
is_valid = totp.verify(entered_code)

OTP Generation

# 6-digit random OTP
otp = ''.join(random.choices(string.digits, k=6))

Time Calculation

# Remaining time for TOTP
remaining = 30 - (int(time.time()) % 30)

Use Cases

• Two-Factor Authentication (2FA): Add extra security layer
• Login Systems: Secure user authentication
• Transaction Verification: Confirm sensitive operations
• Password Reset: Verify user identity
• Account Recovery: Secure account access
• Learning: Understand OTP systems

Learning Outcomes

• OTP generation algorithms
• Time-based authentication
• Security best practices
• GUI development
• Timer implementation
• Real-time updates
• User authentication flows

Real-World Applications

TOTP Apps

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password

OTP Services

• Twilio (SMS)
• SendGrid (Email)
• AWS SNS
• Firebase Auth

Security Considerations

Best Practices

• ✅ Use TOTP when possible (more secure)
• ✅ Set reasonable expiry times
• ✅ Limit verification attempts
• ✅ Use HTTPS for transmission
• ✅ Store secrets securely
• ✅ Implement rate limiting

Avoid

• ❌ Sending OTP via insecure channels
• ❌ Reusing OTP codes
• ❌ Long expiry times
• ❌ Predictable OTP patterns
• ❌ Storing OTP in plain text

Integration Examples

With Email

import smtplib
# Send OTP via email
server = smtplib.SMTP('smtp.gmail.com', 587)
server.sendmail(from_addr, to_addr, f"Your OTP: {otp}")

With SMS (Twilio)

from twilio.rest import Client
client = Client(account_sid, auth_token)
client.messages.create(
    body=f"Your OTP: {otp}",
    from_='+1234567890',
    to='+0987654321'
)

Future Enhancements

• QR code generation for TOTP setup
• Multiple user accounts
• OTP history logging
• Attempt limiting
• Email/SMS integration
• Backup codes
• Biometric fallback
• Custom OTP length
• Custom expiry times
• Database storage
• API endpoints
• Mobile app version

Troubleshooting

TOTP not matching

• Check system time is correct
• Ensure time sync enabled
• Verify secret key

OTP expired

• Generate new OTP
• Check expiry time settings
• Verify system time

Verification fails

• Double-check entered code
• Ensure no extra spaces
• Try generating new code

Comparison: TOTP vs SMS OTP

Feature	TOTP	SMS OTP
Security	High	Medium
Cost	Free	Paid (SMS fees)
Speed	Instant	Delayed
Offline	Works	Requires network
Setup	One-time	Every use
User Experience	Better	Familiar

License

Open source for educational purposes.

Disclaimer

This is a demonstration/learning tool. For production use:

• Implement proper secret storage
• Add rate limiting
• Use secure communication channels
• Follow security best practices
• Consider using established auth services