HMAC Based One Time Passwords, often shortened to HOTP, are short numeric codes that a login system and a device generate from a shared secret and a counter. Each code is meant to be used once.
Most people meet HOTP without knowing its name. A bank, employer, or cloud service may ask for a six-digit code from an app or a small hardware token after you type your password.
Why a Code That Changes Each Time Matters
A password that never changes can be copied once and reused many times. If someone observes or steals it, they can log in whenever they like until you notice and reset it. One-time codes address this by making each login proof different from the last, so a copied code is useful only once and only for a short window.
Consider a hypothetical example: you enter your password at a coffee shop and the site asks for a six-digit code from your phone. Even if someone watched you type the password, they would still need the code that appears on your phone at that moment. The password alone is no longer enough.
HMAC Based One Time Passwords are one of the oldest standardized ways to produce these codes. Their design is simple, predictable, and widely supported, which is why they still appear in many products today.
The Building Blocks: HMAC, Secrets and Counters
HMAC stands for Hash-based Message Authentication Code. It is a method that combines a secret key with a hash function, a mathematical process that turns input data into a fixed-length scrambled output. Only someone who knows the secret key can produce a correct HMAC for a given message, and even small changes to the message change the output completely.
In HOTP, the message being authenticated is a counter, a number that both sides increase each time a code is generated or accepted. The device and the server each hold the same secret key, which is shared once during setup. Because both start from the same key and the same counter, they can independently compute the same code.
The standard is defined in RFC 4226, a document published by the Internet Engineering Task Force. The HMAC output is then reduced to a short decimal code, usually six or eight digits, by a truncation step described in that document. The exact arithmetic is handled by software, so users rarely need to think about it.
How a HOTP Code Is Generated and Checked
The lifecycle of an HOTP code follows a predictable sequence. Each step relies on the shared secret and the counter staying in sync. The points below summarize what happens from setup through each login attempt.
- During enrollment, the server creates a random secret key and shows it to you, usually as a QR code that your authenticator app scans.
- Both the device and the server start with a counter value, commonly zero, stored on each side.
- When you request a code, the device computes an HMAC of the current counter using the secret, then truncates the result to a short number.
- The device then increases its counter so the same code cannot be generated again for the next attempt.
- The server computes the expected code for its own counter and accepts a match, then advances its counter to prevent replay.
Because the counter moves forward on every successful use, an old code is rejected. Many servers also check a small window of counter values ahead of their current position, which tolerates codes generated but not yet entered. Providers choose their own window sizes, so the details differ by service and are worth checking in their documentation.
HOTP Compared With Time-Based Codes
HOTP’s close relative is Time-Based One-Time Password, or TOTP. TOTP uses the same HMAC approach but replaces the counter with the current time, divided into intervals, typically thirty seconds long. Many authenticator apps support both types, and the choice is usually made by the service, not by you.
The practical difference is synchronization. HOTP depends on the counter staying matched between device and server. If you generate many codes without submitting them, the counters can drift apart, and the server may reject codes until it resynchronizes. TOTP depends on the clocks being close to accurate, so drift there causes a different kind of failure.
Neither approach is inherently stronger in a way that changes everyday safety. Both rely on a secret that must stay private. Choose the one your service offers, and focus your attention on protecting the secret and the device that holds it.
Where You Are Likely to Meet HOTP
HOTP appears in several settings. Hardware tokens, small devices with a button and a short display, have historically used HOTP because they do not need a clock that is kept precisely in sync. Some software authenticator apps also support counter-based codes, and some enterprise identity systems use them for employees.
Service providers may offer HOTP as one of several second-factor options alongside time-based codes, push approvals, or security keys. Because the implementation is standardized, a well-built system can usually accept codes from different compliant tools, though setup steps vary by provider.
If you are unsure which type your account uses, look at the setup instructions the service provides or its help pages. The provider should state whether the codes are time-based or counter-based, and it should tell you how to recover access if the device is lost.
Strengths and Weaknesses You Should Understand
HOTP is a sound method when it is set up and handled correctly. Its limitations are less about the mathematics and more about the conditions around it, including how secrets are stored and how users respond to unusual prompts.
Where HOTP Provides Real Protection
A stolen password alone cannot open an account protected by HOTP, which blocks many common attacks that rely only on reused or leaked passwords.
Each code is single-use, so a captured code loses its value quickly once it has been entered. The method also works offline on the device, so a phone or token does not need a network connection to produce a code.
Because the algorithm is public and standardized, its security does not depend on secrecy of the method itself. Strength comes from the length of the secret key and the careful handling of the counter. Well-implemented systems follow these principles, which is why the standard has remained in use for many years.
Limits and Risks to Keep in Mind
Codes can still be phished. If a fake site collects your password and a code and sends them to a real site immediately, the attacker may log in before the code expires. Typing a code into a site you reached through a link in a message is a common way this happens, so verifying the address matters.
Counter drift is another practical issue, and the secret key itself is valuable. Anyone who obtains the secret can generate valid codes indefinitely, so the device storing it needs a screen lock and careful handling. Losing the device without a backup method can lock you out of the account.
Recovery and Design Trade-Offs
Every second-factor method creates a recovery question: what happens when the device is lost or broken? Providers usually issue backup codes during enrollment, which should be stored in a safe place separate from the phone. Some offer a second registered device or a secondary verification path, though each adds its own considerations.
Designers balance convenience and assurance when they choose a method. Codes that must be typed are slower than tapping an approval prompt, but they do not depend on a data connection. Whichever method a service uses, reading its recovery guidance before you need it will save considerable stress later.
Setting Up HOTP Safely on Your Own Devices
Start enrollment only when you are on the genuine service website or app, reached directly rather than through an email link you did not expect.
Scan the setup QR code with a reputable authenticator app, and confirm the account name shown in the app matches the service. Enter the first code only after confirming the setup is complete, then store the backup codes offline.
Keep the authenticator app protected with a device passcode or biometric lock, and avoid sharing the device. Be cautious with apps that offer to copy or export secrets, since moving a secret to a new place increases the number of copies that exist. When changing phones, follow the provider’s transfer steps rather than improvising.
Treat unexpected code prompts as a warning sign. If you receive a code request you did not initiate, do not enter it, change your password through the official site, and report the attempt to the service. Providers and public guidance from agencies such as the Federal Trade Commission describe how to respond to suspected account misuse.
Common Questions About Counter-Based Codes
People often ask whether a code can be reused if it has not expired. Under HOTP, a code is tied to a specific counter value, so once the server accepts it, that code is spent.
This differs from some time-based systems, where a code is valid for a short window and the server should still reject a second use within that window.
Another common question is whether these codes protect against every type of attack. They do not.
HOTP addresses password reuse and many simple intrusion attempts, but it does not stop malware on your device, a real-time phishing relay, or an attacker who gains control of your authenticator. Layered protections such as unique passwords, alerts for new sign-ins, and periodic account reviews remain important.
When you are uncertain about the security of a specific service, the most reliable source is the provider’s own security documentation and its published account protection guidance. Independent references such as NIST’s digital identity guidelines are also useful for understanding general principles of authentication.
Checklist for Using HOTP Codes Confidently
The following checks help readers get the benefit of one-time codes while avoiding the most common mistakes. Work through them when you set up a new account or review an existing one.
- Confirm that the login page is the official site before you enter a password or a code.
- Save backup codes offline, such as in a locked drawer, not as a screenshot on the same phone.
- Protect the phone or token with a strong device passcode and automatic screen lock.
- Test your code generator once after setup by logging out and signing back in.
- Review which devices and apps hold your authenticator, and remove any you no longer use.
Keep this list in mind as a routine, not a one-time task. Reviewing it every few months takes little time and catches changes such as a new phone or a retired device. Good habits, combined with a service that follows established standards, give HOTP its practical value.
Planning Your Next Steps With One-Time Codes
If you already use HMAC Based One Time Passwords, the most useful next step is a short audit. List each account that asks for a code, note whether it uses counter-based or time-based codes, and confirm that backup methods are current. Replace any old or damaged backup codes and remove authenticator entries for services you no longer use.
If you are choosing an account protection method for the first time, compare the options your provider offers. Consider how each one behaves when you travel, lose a phone, or lack a data connection. Matching the method to your situation matters more than picking the most elaborate option.
Looking ahead, many services are moving toward phishing-resistant methods such as security keys and passkeys, which bind authentication to the genuine site. HOTP remains a meaningful improvement over passwords alone, and understanding it prepares you to evaluate newer options as they become available in the accounts you use.