Implementing 2FA: Authy vs OTPlib vs Speakeasy

Adding Two-Factor Authentication (2FA) to your application usually means deciding between building it yourself using open standards or buying a managed service. authy, otplib, and speakeasy represent these two paths. Let's look at how they handle the core tasks of generating secrets, creating QR codes, and verifying tokens.

🏗️ Architecture: Managed Service vs. Self-Hosted Library

authy acts as a client for Twilio's cloud infrastructure.

• You do not generate or store the secret keys yourself; Authy does it.
• Your server talks to Authy's API to register users and verify codes.
• This shifts the security burden of key storage to Twilio but introduces a network dependency.

// authy: Registering a user via API
const authy = require('authy')(API_KEY);

authy.users.new({ email: 'user@example.com', cell: '1234567890' }, (err, res) => {
  if (err) throw err;
  // Authy returns an ID; they store the secret internally
  console.log(`User ID: ${res.user.id}`);
});

otplib is a pure, self-contained library.

• You generate the secret, store it in your own database, and verify codes locally.
• No external API calls are needed during login, making it faster and cheaper at scale.
• It gives you full ownership of the security model.

// otplib: Generating a secret locally
import { authenticator } from 'otplib';

const secret = authenticator.generateSecret();
// You must save this 'secret' to your database associated with the user
const token = authenticator.generate(secret);

speakeasy is also a self-contained library, similar to otplib.

• It handles secret generation and verification entirely on your server.
• It has been around longer and uses a slightly older coding style but functions similarly.
• Like otplib, you are responsible for database storage of the shared secret.

// speakeasy: Generating a secret locally
const speakeasy = require('speakeasy');

const secret = speakeasy.generateSecret({ length: 20 });
// You must save 'secret.base32' to your database
const token = speakeasy.totp({ secret: secret.base32, encoding: 'base32' });

🔑 Secret Generation and Storage

How you handle the "shared secret" is the biggest difference between these tools.

authy hides the secret from you.

• When you register a user, Authy generates the key and stores it on their servers.
• You only get a User ID.
• This is safer if you are worried about leaking your database, but you cannot easily migrate away from Authy later.

// authy: No secret exposed
// The 'res.user.id' is your reference; the actual cryptographic secret is hidden
authy.users.new({ email: '...' }, (err, res) => {
  const authyId = res.user.id; 
  // Save authyId to your DB, NOT a secret key
});

otplib gives you a raw string to store.

• It generates a random Base32 string.
• You must encrypt this column in your database because anyone with this string can generate valid 2FA codes.
• This allows you to switch libraries or providers later if needed.

// otplib: You manage the secret
const secret = authenticator.generateSecret();
// Save 'secret' to DB. Ensure this column is encrypted at rest.
await db.users.update({ id: 1, twoFactorSecret: encrypt(secret) });

speakeasy provides an object with multiple formats.

• It returns the secret in Base32, Hex, and ASCII.
• Most apps use the Base32 version for compatibility with Google Authenticator.
• Like otplib, you bear the responsibility of securing this data.

// speakeasy: You manage the secret
const secret = speakeasy.generateSecret({ name: 'MyApp' });
// Save 'secret.base32' to DB
await db.users.update({ id: 1, twoFactorSecret: encrypt(secret.base32) });

📱 QR Code Generation for Setup

Users need to scan a QR code to add your app to their authenticator (like Google Authenticator or Authy App).

authy generates the QR code URL for you.

• You ask the API for the QR code, and it returns an image URL or barcode string.
• This ensures the QR code format is always correct for the Authy app.

// authy: Fetch QR code from API
authy.users.qrCode(authyId, (err, res) => {
  if (err) throw err;
  // Returns a URL to the QR code image hosted by Authy
  const imageUrl = res.qr_code;
});

otplib does not generate images directly.

• It provides a helper to create the otpauth:// URL string.
• You must use a separate library (like qrcode) to turn that string into an image.
• This adds a step but gives you full control over the image styling.

// otplib: Generate URL string, then use a separate library
import { authenticator } from 'otplib';
import QRCode from 'qrcode';

const secret = authenticator.generateSecret();
const otpauth = authenticator.keyuri('user@example.com', 'MyApp', secret);

// Generate the actual image data separately
const qrImageData = await QRCode.toDataURL(otpauth);

speakeasy also provides the URL string, not the image.

• It includes a google_auth_qr property in the generated secret object for convenience.
• Like otplib, you need a separate package to render the final image.

// speakeasy: Generate URL string, then use a separate library
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');

const secret = speakeasy.generateSecret({ name: 'MyApp:user@example.com' });
// secret.google_auth_qr contains the otpauth:// URL
const qrImageData = await QRCode.toDataURL(secret.google_auth_qr);

✅ Verifying Tokens During Login

When a user types in their 6-digit code, your server must check if it matches.

authy sends the code to the cloud for verification.

• Your server sends the token and User ID to Twilio.
• Twilio checks it and tells you yes or no.
• This adds network latency to every login attempt.

// authy: Verify via API call
authy.users.verify({ token: '123456', id: authyId }, (err, res) => {
  if (res.token === 'is valid') {
    // Login successful
  }
});

otplib verifies locally using math.

• Your server takes the stored secret and the user's input.
• It calculates the expected code and compares them instantly.
• This is extremely fast and works even if your server has no internet access.

// otplib: Local verification
const isValid = authenticator.verify({ token: '123456', secret: storedSecret });
if (isValid) {
  // Login successful
}

speakeasy also verifies locally.

• It uses the same TOTP algorithm as otplib.
• It allows you to adjust the "window" of time (e.g., accept codes from 30 seconds ago) to handle clock skew.

// speakeasy: Local verification
const isValid = speakeasy.totp.verify({
  secret: storedSecret,
  encoding: 'base32',
  token: '123456',
  window: 1 // Accepts previous/next token for clock drift
});
if (isValid) {
  // Login successful
}

🌐 Real-World Scenarios

Scenario 1: SaaS Startup Needing SMS Fallback

You want users to have an app, but also need to send SMS codes if they lose their phone.

• ✅ Best choice: authy
• Why? It handles both App tokens and SMS delivery in one API. Building SMS logic yourself is complex and expensive.

// authy: Request SMS fallback easily
authy.users.requestSMS(authyId, (err, res) => {
  // Twilio sends the code via SMS automatically
});

Scenario 2: High-Security Internal Tool

You are building a dashboard for a bank. Data never leaves the private network.

• ✅ Best choice: otplib
• Why? It requires no external API calls. You keep the secrets in your encrypted DB, ensuring zero data leakage to third parties.

// otplib: Fully offline verification
const valid = authenticator.verify({ token, secret });
// No network request made

Scenario 3: Quick Prototype or Legacy Maintenance

You need to add 2FA to an old Node.js app quickly with minimal config.

• ✅ Best choice: speakeasy
• Why? It has simple documentation and works out of the box with many existing tutorials. Good for getting something running fast.

// speakeasy: Simple setup
const token = speakeasy.totp({ secret: secret.base32, encoding: 'base32' });

📌 Summary Table

💡 Final Recommendation

Think about control versus convenience.

• Need SMS, Push, and easy setup? → Choose authy. You trade control for a feature-rich service that handles the hard parts of delivery.
• Building a modern, secure app from scratch? → Choose otplib. It is modular, actively maintained, and keeps your data in your hands. It is the standard for new Node.js projects today.
• Maintaining older code or need a quick fix? → speakeasy will get the job done, but for any new major project, otplib is the stronger technical choice due to its modern architecture and active development.