Two-Factor Authentication System

A Python-based two-factor authentication project implementing Time-Based One-Time Passwords (TOTP) using PyOTP and QR-code based authenticator enrolment.

Overview

This project demonstrates how two-factor authentication can strengthen an authentication process by requiring a temporary verification code generated by an authenticator application.

The application generates a temporary TOTP secret, creates an enrolment QR code, and verifies a six-digit one-time password entered by the user.

Features

• Time-Based One-Time Password (TOTP) authentication
• Random TOTP secret generation
• QR-code based authenticator enrolment
• Six-digit OTP validation
• Detection of invalid or expired authentication codes
• Temporary QR-code generation
• Automatic deletion of generated QR codes after authentication
• Compatible with standard TOTP authenticator applications

Technologies

• Python
• PyOTP
• QRCode
• Pillow

How It Works

Generate TOTP Secret
        ↓
Create Provisioning URI
        ↓
Generate QR Code
        ↓
Scan With Authenticator
        ↓
Authenticator Generates OTP
        ↓
Enter 6-Digit OTP
        ↓
Verify OTP
        ↓
Authentication Result

The same randomly generated secret is used for both QR-code enrolment and OTP verification.

Project Preview

The screenshot above demonstrates a successful authentication attempt using a temporary TOTP credential.

Installation

Clone the repository:

git clone https://github.com/azelthong/two-factor-authentication.git

Navigate into the project directory:

cd two-factor-authentication

Install the required dependencies:

pip install -r requirements.txt

Running the Project

Run:

python main.py

The application will:

1. Generate a temporary TOTP secret.
2. Generate a QR code for authenticator enrolment.
3. Open the QR code automatically on Windows.
4. Ask for the six-digit authentication code.
5. Verify the submitted code.
6. Delete the temporary QR code after the demonstration.

Security Considerations

This repository is intended for educational and demonstration purposes.

TOTP secrets and enrolment QR codes should be treated as sensitive authentication material. A TOTP QR code contains information that can allow another party to generate valid authentication codes.

For this reason:

• A new disposable secret is generated each time the program runs.
• The TOTP secret is not hard-coded into the source code.
• The secret is not printed to the console.
• Generated QR codes are excluded from Git using .gitignore.
• The temporary QR code is deleted after the demonstration.
• Real authentication credentials should never be committed to a public repository.

What I Learned

Through this project, I gained practical experience with:

• Multi-factor authentication concepts
• Time-Based One-Time Passwords
• TOTP secret generation
• QR-code based authenticator enrolment
• Authentication verification logic
• Handling time-sensitive credentials
• Secure handling of authentication material
• Python package integration

Future Improvements

Potential improvements include:

• Adding username and password authentication
• Supporting multiple user accounts
• Securely storing encrypted TOTP secrets
• Adding recovery codes
• Implementing failed-attempt rate limiting
• Adding backup authentication methods
• Developing a graphical or web-based interface

Author

Azel Thong

• GitHub: https://github.com/azelthong
• LinkedIn: https://www.linkedin.com/in/azel-thong-532084274/