Two-Factor Authentication (2FA) — Time-Limited OTP via Email/SMS

1. Introduction

The Two-Factor Authentication (2FA) System Using OTP is a Python project that adds a dynamic, time-limited One-Time Password to standard username/password logins. OTPs are generated with cryptographically secure methods and delivered via Email (SMTP) or SMS (Twilio). Only users who both know the password and possess the OTP can log in, defeating credential leaks and password reuse.

2. Existing System vs Proposed System

3. Working

1. User Login Attempt: Enter username & password.
2. Step 1 Validation: Credentials checked in DB.
3. OTP Generation: Secure 6-digit code created.
4. OTP Delivery: Sent via Email (SMTP) or SMS (Twilio).
5. Step 2 Verification: User inputs OTP in UI.
6. Access: Granted if OTP matches and is within expiry; else denied.

4. Technology Stack

• Language: Python
• Libraries: smtplib, pyotp, secrets/random, time, Flask/Tkinter, hashlib
• Backend: SQLite3 (users, OTP logs, timestamps)
• APIs: Twilio (SMS), SMTP (Email)
• Security: SHA-256 password hashing, HMAC/pyotp OTP validation, rate limiting

5. Modules

6. Advantages

• Strong protection against theft/phishing.
• Time-based OTPs with auto-expiry.
• Easy integration into existing logins/APIs.
• Scales from small apps to large user bases.
• Flexible Email/SMS channels.

7. Applications

• Banking, payments, and e-commerce auth.
• Enterprise/government portal logins.
• Education/healthcare systems with sensitive data.
• IoT/smart home secure access.

Python Integration Sketch (Flask + pyotp/SMTP/Twilio)

# 1) Password check
user = db.get_user(email)
if not verify_sha256(password, user.hash): deny_login()

# 2) Generate OTP (TOTP or random)
# Option A: Time-based (pyotp)
totp = pyotp.TOTP(user.secret, interval=120, digits=6)
otp_code = totp.now()

# Option B: Random 6-digit
otp_code = f"{secrets.randbelow(1000000):06d}"
db.store_otp(user.id, otp_code, expires_at=now()+120s)

# 3) Deliver via Email or SMS
send_email_smtp(user.email, template("Your OTP", otp_code))
# or
send_sms_twilio(user.phone, f"Your OTP is {otp_code}. It expires in 2 minutes.")

# 4) Verify OTP
def verify_otp(input_code):
    if TOTP_mode:
        return totp.verify(input_code, valid_window=1)   # slight clock skew
    else:
        rec = db.fetch_latest_otp(user.id)
        return rec.code == input_code and now() < rec.expires_at

# 5) On success -> create session; else -> log + deny + lockout on retries
              

What You Get