HOTP
also: HMAC-based One-Time Password
HOTP (HMAC-based One-Time Password) is a time-independent algorithm that generates single-use authentication codes based on a shared secret and a counter value, commonly used in two-factor authentication systems.
HOTP is a standardized method (RFC 4226) for generating one-time passwords using an HMAC function combined with an incrementing counter. Each time a code is generated, the counter increases, ensuring each password is unique and used only once.
Unlike TOTP (Time-based One-Time Password), HOTP is counter-based rather than time-based, making it suitable for scenarios where synchronized time cannot be relied upon. The server and client share a secret key, and both maintain a counter that increments together.
Example: A hardware token or mobile app generates a 6-digit code like 123456 for initial login. On the next authentication, a new code like 987654 is generated by incrementing the counter, with the old code becoming invalid.
HOTP is used in enterprise security, banking applications, and some two-factor authentication implementations, though TOTP has become more popular due to its simpler synchronization model.