HeartSeedOTP

• 

• 

  result of the cv generation through heart beat

Inspiration

We were inspired by the idea that security is still largely detached from the human body. Passwords are forgettable, tokens are stealable, and devices can be lost — but your heartbeat is always with you. We wanted to explore whether natural physiological signals could become a new layer of digital trust. HeartSeedOTP was born from the question: Can your own heartbeat help protect your digital identity?

What it does

HeartSeedOTP generates a personalized one-time password (OTP) derived from a user’s real heart-rate data. It extracts meaningful patterns from heartbeat variability, converts them into a cryptographic “Heart Seed” using SHA-256, and then transforms that seed into a human-friendly OTP. The system also includes a simple visual app where users can press a button and instantly receive their bio-based OTP.

How we built it

We built HeartSeedOTP in Python using a four-stage pipeline:

Fetch real heart-rate data from Google Fit,

Process the data to extract heart variability features,

Combine these features with secure randomness and hash them into a Heart Seed, and

Convert the seed into a short OTP displayed through a Tkinter-based graphical interface. We used pandas and numpy for data processing, Google Fit APIs for data access, and hashlib for cryptographic hashing.

Challenges we ran into

The biggest challenge was working with real-world health data. Google Fit returned inconsistent or empty datasets depending on device and sync settings, forcing us to debug API timestamps, data formats, and permissions. We also had to carefully balance security with usability — making something strong enough for research while still simple enough for users to understand and test.

Accomplishments that we're proud of

We are proud of creating an end-to-end bio-cryptographic system that actually works with real health data rather than simulated inputs. We successfully connected to Google Fit, extracted meaningful biometric features, generated a secure Heart Seed, and built a one-click visual OTP app. Most importantly, we demonstrated that physiology can meaningfully contribute to digital security.

What we learned

We learned that biometrics are not just identifiers — they can also be sources of entropy for security systems. We also gained deep experience in API integration, data cleaning, cryptographic hashing, and user interface design. Perhaps most importantly, we realized how fragile real-world data pipelines can be, and why robustness matters as much as innovation.

What’s next for HeartSeedOTP

Next, we plan to:

Add Apple Health and Samsung Health support,

Implement time-based Heart OTP that updates automatically every 1–2 minutes,

Improve randomness analysis of the Heart Seed for academic validation,

Explore mobile app development, and

Investigate using additional biosignals (like breathing or activity patterns) to strengthen security further.

Built With

• api
• google-cloud
• python