TOTP vs HOTP: what is the difference?
TOTP is time-based, HOTP is counter-based. Learn the difference, when each is used, and generate a working TOTP code with our free tool.
TOTP and HOTP are the two HMAC-based one-time-password algorithms from the OATH standards. They share the same core but differ in what drives the moving value: HOTP uses a counter (RFC 4226); TOTP uses the clock (RFC 6238).
HOTP: counter-based
HOTP increments a counter every time a code is generated. The server and token must keep their counters in sync; if you generate codes without using them, the counters drift and the server has to "look ahead" to resync. HOTP codes do not expire on their own — a code stays valid until it is used or the counter moves past it.
TOTP: time-based
TOTP replaces the counter with the current time divided into fixed windows (usually 30 seconds). No stored counter, no drift from unused codes — the only thing to keep in sync is the clock. This is why almost every consumer 2FA app uses TOTP.
Which should you use?
For app-based 2FA, use TOTP: it self-expires and needs no counter bookkeeping. HOTP is mostly seen in hardware tokens and offline scenarios where a reliable clock is not guaranteed.
Try it now — free, no signup
Use the TOTP generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.