npm / otplib

otplib

What changed in otplib 13, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

4 breaking9 security5 new APIs and options2 behavior and defaults1 tooling

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

otplib 1321 changes

All crypto plugins now reject unsupported hash algorithm strings instead of silently substituting a different digest; accepted algorithms and aliases are documented.
13.5.0release notes
Unsupported hash algorithms now throw AlgorithmUnsupportedError, giving callers a specific error to handle instead of plugin-dependent errors or silent fallback.
13.5.0release notes
HOTP counterTolerance now uses tuple semantics with type [number, number] and a look-ahead default; check existing HOTP tolerance values.
13.2.0release notes
Secrets now require a minimum of 16 bytes; override MIN_SECRET_BYTES to interoperate with shorter existing secrets.
13.0.0release notes

An ajv override was added to address a moderate ReDoS vulnerability.
13.4.0release notes
A markdown-it ReDoS vulnerability was resolved.
13.4.0release notes
An undici override was added to address a security alert.
13.4.0release notes
OTP validation was hardened.
13.3.0release notes
Security improvements were made; the notes do not specify their details.
13.3.0release notes
An HOTP update-counter command was added.
13.3.0release notes
URI parsing was hardened.
13.3.0release notes
Adds the afterTimeStep parameter for TOTP replay protection.
13.2.0release notes
The guardrails parameter now propagates through HOTP and TOTP call chains.
13.1.1release notes

otplib adds IIFE and CDN build support, enabling those build formats.
13.4.0release notes
OTPHooks were added for custom token encoding and validation.
13.3.0release notes
Adds hex and base64 bypass plugins.
13.2.0release notes
Adds a plugin for bypassing Base32 encoding.
13.2.0release notes
Guardrails can now be overridden.
13.1.0release notes