๐ข HOTP (Counter-Based) Code Generator
Enter a secret and counter
Generate an HOTP (HMAC-based one-time password), defined in RFC 4226, from a Base32-encoded secret and a counter value. Unlike TOTP, which derives its code from the current time, HOTP derives it from an explicit counter that increments by 1 with each use โ the scheme used by many hardware tokens.
How to use
- Enter the Base32-encoded secret key.
- Enter a counter value (typically starting at 0 and incrementing by 1 with each authentication).
- The generated one-time password is shown.
FAQ
What's the difference between HOTP and TOTP?
Both use the same RFC 4226 HMAC-based OTP mechanism, but TOTP (RFC 6238) uses the current time divided into fixed intervals in place of a counter, while HOTP uses an explicit counter (typically incremented by 1 on each successful authentication).
Why do I need to increment the counter manually?
If the server and client counters drift out of sync, the generated code won't match. In real deployments, both sides increment the counter together on successful authentication. This tool includes manual ยฑ1 buttons for testing.
Has this been verified against the RFC 4226 test vectors?
Yes โ the implementation exactly matches the official test vectors in RFC 4226 Appendix D (secret "12345678901234567890", counters 0 through 9).