# What changed in otplib

> 21 changes in otplib 13 from its official release notes, upgrade guides and advisories: 4 breaking, 9 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/otplib/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## otplib 13

### Breaking changes

- All crypto plugins now reject unsupported hash algorithm strings instead of silently substituting a different digest; accepted algorithms and aliases are documented. (13.5.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.5.0)
- Unsupported hash algorithms now throw AlgorithmUnsupportedError, giving callers a specific error to handle instead of plugin-dependent errors or silent fallback. (13.5.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.5.0)
- HOTP counterTolerance now uses tuple semantics with type [number, number] and a look-ahead default; check existing HOTP tolerance values. (13.2.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.2.0)
- Secrets now require a minimum of 16 bytes; override MIN_SECRET_BYTES to interoperate with shorter existing secrets. (13.0.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.0.0)

### Security

- An ajv override was added to address a moderate ReDoS vulnerability. (13.4.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.4.0)
- A markdown-it ReDoS vulnerability was resolved. (13.4.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.4.0)
- An undici override was added to address a security alert. (13.4.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.4.0)
- OTP validation was hardened. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- Security improvements were made; the notes do not specify their details. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- An HOTP update-counter command was added. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- URI parsing was hardened. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- Adds the afterTimeStep parameter for TOTP replay protection. (13.2.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.2.0)
- The guardrails parameter now propagates through HOTP and TOTP call chains. (13.1.1) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.1.1)

### New APIs and options

- otplib adds IIFE and CDN build support, enabling those build formats. (13.4.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.4.0)
- OTPHooks were added for custom token encoding and validation. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- Adds hex and base64 bypass plugins. (13.2.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.2.0)
- Adds a plugin for bypassing Base32 encoding. (13.2.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.2.0)
- Guardrails can now be overridden. (13.1.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.1.0)

### Behavior and default changes

- TOTP replay controls are now bubbled up through otplib. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)
- generateURI now supports HOTP as well as TOTP strategies. (13.1.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.1.0)

### Tooling

- An otplib CLI application was added for developers to use. (13.3.0) — [release notes](https://github.com/yeojz/otplib/releases/tag/v13.3.0)