Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

mfa

package

Go to main page

Versions in this module

v1

v1.2.3

Feb 21, 2026

v1.2.2

Jan 29, 2026

v1.2.1

Jan 24, 2026

v1.2.0

Jan 18, 2026

v1.1.9

Jan 18, 2026

v1.1.8

Jan 17, 2026

Changes in this version

+ const AlgorithmSHA1

+ const AlgorithmSHA256

+ const AlgorithmSHA512

+ const DigitsEight

+ const DigitsSix

+ var ErrInvalidMFAConfig = ewrap.New("invalid mfa config")

+ var ErrMFABackupGenerationFailed = ewrap.New("mfa backup code generation failed")

+ var ErrMFABackupHashFailed = ewrap.New("mfa backup code hashing failed")

+ var ErrMFABackupVerificationFailed = ewrap.New("mfa backup code verification failed")

+ var ErrMFAConflictingOptions = ewrap.New("mfa options are conflicting")

+ var ErrMFAInvalidCode = ewrap.New("mfa otp code is invalid")

+ var ErrMFAInvalidCounter = ewrap.New("mfa counter is invalid")

+ var ErrMFAInvalidSecret = ewrap.New("mfa secret is invalid")

+ var ErrMFAMissingAccountName = ewrap.New("mfa account name is required")

+ var ErrMFAMissingIssuer = ewrap.New("mfa issuer is required")

+ var ErrMFARateLimited = ewrap.New("mfa rate limit exceeded")

+ var ErrMFASecretTooLong = ewrap.New("mfa secret is too long")

+ var ErrMFASecretTooShort = ewrap.New("mfa secret is too short")

+ func GenerateHOTPKey(opts ...HOTPKeyOption) (*otp.Key, error)

+ func GenerateTOTPKey(opts ...TOTPKeyOption) (*otp.Key, error)

+ type Algorithm = otp.Algorithm

+ type BackupCodeManager struct

+ func NewBackupCodeManager(opts ...BackupOption) (*BackupCodeManager, error)

+ func (m *BackupCodeManager) Generate() (BackupCodeSet, error)

+ func (m *BackupCodeManager) Verify(code string, hashes []string) (bool, []string, error)

+ type BackupCodeSet struct

+ Codes []string

+ Hashes []string

+ type BackupHasher interface

+ Hash func(code []byte) (string, error)

+ Verify func(code []byte, hash string) (bool, error)

+ type BackupOption func(*backupConfig) error

+ func WithBackupCodeAlphabet(alphabet string) BackupOption

+ func WithBackupCodeCount(count int) BackupOption

+ func WithBackupCodeGroupSize(size int) BackupOption

+ func WithBackupCodeLength(length int) BackupOption

+ func WithBackupCodeReader(reader io.Reader) BackupOption

+ func WithBackupHasher(hasher BackupHasher) BackupOption

+ func WithBackupHasherArgon2id(params password.Argon2idParams) BackupOption

+ func WithBackupHasherBcrypt(cost int) BackupOption

+ func WithBackupRateLimiter(limiter RateLimiter) BackupOption

+ type Digits = otp.Digits

+ type HOTP struct

+ func NewHOTP(secret string, opts ...HOTPOption) (*HOTP, error)

+ func (h *HOTP) Generate(counter uint64) (string, error)

+ func (h *HOTP) Resync(code1, code2 string, counter uint64) (bool, uint64, error)

+ func (h *HOTP) Verify(code string, counter uint64) (bool, uint64, error)

+ type HOTPKeyOption func(*hotpKeyConfig) error

+ func WithHOTPKeyAccountName(account string) HOTPKeyOption

+ func WithHOTPKeyAlgorithm(algorithm Algorithm) HOTPKeyOption

+ func WithHOTPKeyDigits(digits Digits) HOTPKeyOption

+ func WithHOTPKeyIssuer(issuer string) HOTPKeyOption

+ func WithHOTPKeySecretSize(secretSize int) HOTPKeyOption

+ type HOTPOption func(*hotpConfig) error

+ func WithHOTPAlgorithm(algorithm Algorithm) HOTPOption

+ func WithHOTPDigits(digits Digits) HOTPOption

+ func WithHOTPRateLimiter(limiter RateLimiter) HOTPOption

+ func WithHOTPResyncWindow(resyncWindow uint) HOTPOption

+ func WithHOTPSecretMinBytes(minBytes int) HOTPOption

+ func WithHOTPWindow(lookAhead uint) HOTPOption

+ type RateLimiter interface

+ Allow func() (bool, error)

+ type TOTP struct

+ func NewTOTP(secret string, opts ...TOTPOption) (*TOTP, error)

+ func (t *TOTP) Generate() (string, error)

+ func (t *TOTP) Verify(code string) (bool, error)

+ func (t *TOTP) VerifyWithStep(code string) (bool, uint64, error)

+ type TOTPKeyOption func(*totpKeyConfig) error

+ func WithTOTPKeyAccountName(account string) TOTPKeyOption

+ func WithTOTPKeyAlgorithm(algorithm Algorithm) TOTPKeyOption

+ func WithTOTPKeyDigits(digits Digits) TOTPKeyOption

+ func WithTOTPKeyIssuer(issuer string) TOTPKeyOption

+ func WithTOTPKeyPeriod(period time.Duration) TOTPKeyOption

+ func WithTOTPKeySecretSize(secretSize int) TOTPKeyOption

+ type TOTPOption func(*totpConfig) error

+ func WithTOTPAlgorithm(algorithm Algorithm) TOTPOption

+ func WithTOTPAllowedSkew(skew uint) TOTPOption

+ func WithTOTPClock(clock func() time.Time) TOTPOption

+ func WithTOTPDigits(digits Digits) TOTPOption

+ func WithTOTPPeriod(period time.Duration) TOTPOption

+ func WithTOTPRateLimiter(limiter RateLimiter) TOTPOption

+ func WithTOTPSecretMinBytes(minBytes int) TOTPOption