HOTP: what it is and how it differs from TOTP
HOTP generates a one-time code from a shared secret and a counter that advances every time you use it, instead of the clock. It's the predecessor of TOTP, and today almost nobody chooses it directly.
- What it is
- Counter-based code
- Since
- 2005 (RFC 4226)
- Verdict
- No
What it is
HOTP is a method for generating one-time codes: every time you use it, an internal counter moves forward one position, and that number — together with a shared secret — produces the next code. It's the same principle as TOTP, but with a counter instead of the clock as the variable that changes.
The practical problem is that the device's counter and the service's counter have to stay in sync: if you press the button several times without actually using those codes, they fall out of sync and need to be reset.
Since when
The IETF published HOTP as RFC 4226 in December 2005, as joint work from the OATH (Open Authentication) initiative. It was the foundation TOTP was later built on.
Why it's used
It was mainly used in early hardware tokens with a physical button — some banking devices and some older security keys — before authenticator apps with TOTP became widespread.
Today it still lives on, invisibly, inside some older banking devices and certain security keys, but it's not something you have to choose or configure yourself anymore: modern apps use TOTP, and modern keys use FIDO2.
Do we use it?
Not something you need to choose: almost nobody uses it directly anymore. If you have it, it's because it comes built into an older device, not because you turned it on yourself.
Check this
- Do you use any older banking device with a button that generates a code when pressed?
- If that code fails, do you know who to call to resync it?
Official source: RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm (IETF)