HOTP Token Generator
Token GenerationProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool implements the HOTP algorithm as defined in RFC 4226. It generates counter-based one-time passwords using HMAC-SHA1, the same underlying mechanism used by hardware tokens and many 2FA systems.
Algorithm Details
- Algorithm: HOTP (RFC 4226)
- HMAC function: HMAC-SHA1
- Secret format: Base32 encoded (A-Z, 2-7)
- Output: 6, 7, or 8 digit numeric code
- Dynamic truncation: RFC 4226 Section 5.3
- Implementation: Pure TypeScript — no external libraries
How HOTP Works
- The shared secret (Base32) is decoded to raw bytes
- The counter value is encoded as an 8-byte big-endian integer
- HMAC-SHA1 is computed:
HMAC(secret, counter) - Dynamic truncation extracts a 4-byte binary code
- The code is reduced modulo 10^digits to produce the final OTP
HOTP vs TOTP
HOTP is counter-based — each code is tied to a specific counter value. TOTP (Time-based OTP, RFC 6238) replaces the counter with the current Unix time divided by a time step (usually 30 seconds). TOTP is what apps like Google Authenticator use day-to-day, but HOTP is the foundation and is still used in hardware tokens and certain authentication protocols.
Frequently Asked Questions
What is HOTP?
HOTP (HMAC-based One-Time Password) generates a one-time password using a shared secret key and a counter value. Defined in RFC 4226, it is the foundation of many two-factor authentication systems.
What is the difference between HOTP and TOTP?
HOTP uses a counter that increments with each use, while TOTP uses the current time. TOTP is what Google Authenticator uses. HOTP doesn't require synchronized clocks but both parties must track the counter.
What Base32 format does the secret use?
Standard Base32 encoding using characters A-Z and 2-7. This is the same format used by Google Authenticator and most 2FA setup URIs. Padding characters (=) are optional.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.