Help: token generated by other libraries does not match with otplib.totp

[ab-acx]

Can you please help me try to figure out why TOTP tokens generated by other libraries don't match. Here is the code that I am using

const speakeasy = require('speakeasy');
const otpauth = require('otpauth');
const otplib = require('otplib');

const secret = 'this is a secret';
const digits = 6;
const period = 30;
const algorithm = 'sha1';

// Get the current epoch time in seconds
const epoch = Math.floor(Date.now() / 1000);

// Generate TOTP using speakeasy
const speakeasyToken = speakeasy.totp({
    secret,
    encoding: 'ascii',
    step: period,
    digits,
    algorithm,
    time: epoch
});
console.log(`Speakeasy Token: ${speakeasyToken}`);

// Generate TOTP using otpauth
const otpauthTOTP = new otpauth.TOTP({
    secret: otpauth.Secret.fromUTF8(secret),
    digits,
    period,
    algorithm
});
const otpauthToken = otpauthTOTP.generate({ time: epoch });
console.log(`OTPAUTH Token: ${otpauthToken}`);

// Generate TOTP using otplib
otplib.totp.options = {
    step: period,
    digits,
    algorithm,
    epoch: epoch * 1000
};
const otplibToken = otplib.totp.generate(secret);
//console.log(`OTPLIB Options: ${JSON.stringify(otplib.totp.allOptions())}`);
console.log(`OTPLIB Token: ${otplibToken}`);

output:

Speakeasy Token: 006867
OTPAUTH Token: 006867
OTPLIB Token: 395990

I am using epoc to make the test more stable however I tried different approaches but none worked.

Thanks

[viperadnan-git]

#580 (comment)

This solved my same issue.

[kamihork]

Since the secret you are entering is a base32 encoded string, decoding it and converting it to hexadecimal may solve the problem!
The authenticator does that, but totp does not.
https://github.com/yeojz/otplib/blob/master/packages/otplib-core/src/authenticator.ts#L191

[ab-acx]

@viperadnan-git

#580 (comment)

This solved my same issue.

changing to otplib.authenticator did not make any difference
const otplibToken = otplib.authenticator.generate(secret);

[ab-acx]

Since the secret you are entering is a base32 encoded string, decoding it and converting it to hexadecimal may solve the problem! The authenticator does that, but totp does not. https://github.com/yeojz/otplib/blob/master/packages/otplib-core/src/authenticator.ts#L191

the secret is 'this is a secret'. it is not base32 encoded.