View as Json

Generate OTP/Token Helper Functions

Cryptographically secure utility functions for generating OTPs, random tokens, and unique identifiers for authentication workflows.

Installation Guide

Install the component using the servercn CLI:

npx servercn-cli add generate-otp-token

File Structure

Core Functions

1. Generate OTP (One-Time Password)

Generate a cryptographically secure numeric OTP of any length (default: 6 digits).

src/helpers/token.helpers.ts
import crypto from "node:crypto";
 
export function generateOTP(length: number = 6, ttlMinutes: number = 5) {
  //? generate random otp code
  const code = crypto
    .randomInt(0, Math.pow(10, length))
    .toString()
    .padStart(length, "0");
 
  //? generate hash of otp code
  const hashCode = crypto
    .createHash("sha256")
    .update(String(code))
    .digest("hex");
 
  //? generate expiration time
  const expiresAt = new Date(Date.now() + ttlMinutes * 60 * 1000).toISOString();
 
  return { code, hashCode, expiresAt };
}

Usage Examples:

//? generate otp with default length and ttl
const otp = generateOTP();
{
  code: '434741',
  hashCode: '8958319959f69db8f78e94c0f3bba4df00f01744769c88d459ff189793bd4fa3',
  expiresAt: '2026-01-15T12:52:00.573Z'
}
//? generate otp with custom length and ttl
const { code, hashCode, expiresAt } = generateOTP(8, 10);
{
  code: '01925315',
  hashCode: '838738959ab68115fbc10e67948bc0bf193bd464a2ff5dc0db9e4270de4693f5',
  expiresAt: '2026-01-15T13:05:13.004Z'
}

2. Verify OTP

Verify an OTP code against its hash and expiration time.

import crypto from "node:crypto";
 
export function verifyOTP(code: string, hashCode: string): boolean {
  const validCode = crypto
    .createHash("sha256")
    .update(String(code))
    .digest("hex");
  return validCode === hashCode;
}

Usage Example:

const isValid = verifyOTP(
  "123456",
  "8958319959f69db8f78e94c0f3bba4df00f01744769c88d459ff189793bd4fa3"
); //? true if valid, false otherwise

3. Generate Secure Random Token

Generate a cryptographically secure random token using hexadecimal encoding.

import crypto from "node:crypto";
 
export function generateSecureToken(length: number = 32): string {
  return crypto.randomBytes(length).toString("hex");
}

Usage Example:

const token = generateSecureToken(); // "a3f5c8e9d2b1f4a6c7e8d9b0a1f2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
const shortToken = generateSecureToken(16); // "a3f5c8e9d2b1f4a6c7e8d9b0a1f2c3d4"

4. Generate Hashed Token

Generate a hashed token using SHA-256.

import crypto from "node:crypto";
 
export function generateHashedToken(token: string): string {
  return crypto.createHash("sha256").update(String(token)).digest("hex");
}

Usage Example:

const hashedToken = generateHashedToken("my-token"); // "8958319959f69db8f78e94c0f3bba4df00f01744769c88d459ff189793bd4fa3"

5. Generate Token and Hashed Token

Generate a token and hashed token using SHA-256.

import crypto from "node:crypto";
 
export function generateTokenAndHashedToken(id: string) {
  const cryptoSecret = process.env.CRYPTO_SECRET! || "secret";
  const token = crypto
    .createHmac("sha256", cryptoSecret)
    .update(String(id))
    .digest("hex");
 
  const hashedToken = crypto
    .createHash("sha256")
    .update(String(token))
    .digest("hex");
  return { token, hashedToken };
}

Usage Example:

const { token, hashedToken } = generateTokenAndHashedToken("my-token");
{
  token: 'b24cec4f5f059638e6945b6b30178b2ac286398dbb4bdf2d78e9d665aa574a24',
  hashedToken: '82d8db5da99e3a848fcfb0c7ee00f60eff7e38d6356df6ecff65e12335bb8e78'
}

6. Verify Hashed Token

Verify a hashed token using SHA-256.

import crypto from "node:crypto";
 
export function verifyHashedToken(token: string, hashedToken: string): boolean {
  return (
    crypto.createHash("sha256").update(String(token)).digest("hex") ===
    hashedToken
  );
}

Usage Example:

const isValid = verifyHashedToken(
  "my-token",
  "8958319959f69db8f78e94c0f3bba4df00f01744769c88d459ff189793bd4fa3"
); // true if valid, false otherwise

7. Generate UUID (Universally Unique Identifier)

Generate a RFC 4122 version 4 UUID.

import crypto from "node:crypto";
 
export function generateUUID(): string {
  return crypto.randomUUID();
}

Usage Example:

const uuid = generateUUID(); // "f47ac10b-58cc-4372-a567-0e02b2c3d479"

8. Generate Alphanumeric Token

Generate a cryptographically secure alphanumeric token (letters + numbers).

import crypto from "node:crypto";
 
export function generateAlphanumericToken(length: number = 32): string {
  const chars =
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
  const randomBytes = crypto.randomBytes(length);
  let token = "";
 
  for (let i = 0; i < length; i++) {
    token += chars[randomBytes[i] % chars.length];
  }
 
  return token;
}

Usage Example:

const token = generateAlphanumericToken(); // "Kx7mP9qR2sT4vW6yZ8aB1cD3eF5gH7jL"
const shortToken = generateAlphanumericToken(16); // "Kx7mP9qR2sT4vW6y"

9. Generate URL-Safe Token

Generate a cryptographically secure URL-safe token (base64url encoding).

import crypto from "node:crypto";
 
export function generateURLSafeToken(length: number = 32): string {
  return crypto
    .randomBytes(length)
    .toString("base64")
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=/g, "");
}

Usage Example:

const token = generateURLSafeToken(); // "Kx7mP9qR2sT4vW6yZ8aB1cD3eF5gH7jL9nM0pQ3rS5tU7vX9wY1zA2bC4dE6fG"

10. Generate Numeric Code

Generate a cryptographically secure numeric code (alternative to OTP with better distribution).

import crypto from "node:crypto";
 
export function generateNumericCode(length: number = 6): string {
  const digits = "0123456789";
  const randomBytes = crypto.randomBytes(length);
  let code = "";
 
  for (let i = 0; i < length; i++) {
    code += digits[randomBytes[i] % 10];
  }
 
  return code;
}

Usage:

const code = generateNumericCode(); // "847392"
const longCode = generateNumericCode(10); // "8473920156"

Complete Implementation

Here's a complete implementation file with all utility functions:

src/helpers/token.helpers.ts
import crypto from "node:crypto";
 
//? generate otp
export function generateOTP(length: number = 6, ttlMinutes: number = 5) {
  const code = crypto
    .randomInt(0, Math.pow(10, length))
    .toString()
    .padStart(length, "0");
  const hashCode = crypto
    .createHash("sha256")
    .update(String(code))
    .digest("hex");
  const expiresAt = new Date(Date.now() + ttlMinutes * 60 * 1000).toISOString();
  return { code, hashCode, expiresAt };
}
 
//? verify otp
export function verifyOTP(code: string, hashCode: string): boolean {
  const validCode = crypto
    .createHash("sha256")
    .update(String(code))
    .digest("hex");
  return validCode === hashCode;
}
 
//? hash otp
export function hashOTP(otp: string): string {
  return crypto.createHash("sha256").update(String(otp)).digest("hex");
}
 
//? generate secure token
export function generateSecureToken(length: number = 32): string {
  return crypto.randomBytes(length).toString("hex");
}
 
//? generate hashed token
export function generateHashedToken(token: string): string {
  return crypto.createHash("sha256").update(String(token)).digest("hex");
}
 
//? generate token and hashed token
export function generateTokenAndHashedToken(id: string) {
  const cryptoSecret = process.env.CRYPTO_SECRET! || "secret";
  const token = crypto
    .createHmac("sha256", cryptoSecret)
    .update(String(id))
    .digest("hex");
 
  const hashedToken = crypto
    .createHash("sha256")
    .update(String(token))
    .digest("hex");
  return { token, hashedToken };
}
 
//? verify hashed token
export function verifyHashedToken(token: string, hashedToken: string): boolean {
  return (
    crypto.createHash("sha256").update(String(token)).digest("hex") ===
    hashedToken
  );
}
 
//? generate uuid
export function generateUUID(): string {
  return crypto.randomUUID();
}
 
//? generate alphanumeric token
export function generateAlphanumericToken(length: number = 32): string {
  const chars =
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
  const randomBytes = crypto.randomBytes(length);
  let token = "";
 
  for (let i = 0; i < length; i++) {
    token += chars[randomBytes[i] % chars.length];
  }
 
  return token;
}
 
//? generate url safe token
export function generateURLSafeToken(length: number = 32): string {
  return crypto
    .randomBytes(length)
    .toString("base64")
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=/g, "");
}
 
//? generate numeric code
export function generateNumericCode(length: number = 6): string {
  const digits = "0123456789";
  const randomBytes = crypto.randomBytes(length);
  let code = "";
 
  for (let i = 0; i < length; i++) {
    code += digits[randomBytes[i] % 10];
  }
 
  return code;
}

File & Folder Structure

Loading files...

Installation

npx servercn-cli add generate-otp-token