Glossary Security

HOTP

HOTP (HMAC-based one-time password) is a one-time code derived from a shared secret and a counter that increases each time a code is used.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

HOTP, defined in RFC 4226, computes an HMAC of an 8-byte counter, takes four bytes from the result by a rule called dynamic truncation, and keeps the last six or eight decimal digits. The server and the token each keep the counter in step. Hardware tokens that generate a code on a button press commonly use HOTP, and TOTP is the same idea with the counter replaced by the time.

Why it matters

Because the counter only moves when a code is used, a token and a server can drift apart if the button is pressed many times without logging in. Servers therefore accept codes within a small look-ahead window and then resynchronise. A code is valid until it is used, not for a fixed number of seconds, which is the main practical difference from TOTP.

Example

With the RFC test secret 12345678901234567890, counters 0, 1 and 2 give the codes 755224, 287082 and 359152.

Common confusion

HOTP and TOTP are often confused because they look identical to the user. The difference is what changes the code: a counter for HOTP, the clock for TOTP.

AdSense Placeholder
Slot: footer_leaderboard