HOTP or TOTP? — TechKnowSurge

About this interactive

With a texted code, the server sends the code. With an authenticator app or a fob, nothing is sent: the device and the server each work the code out for themselves. The HOTP and TOTP lesson shows how. Both start with a shared key, exchanged once ahead of time by typing it in or scanning a QR code. Both hash that key together with a moving value and cut the result down to six or eight digits. HOTP (HMAC-based one-time password) uses a counter. Each new code moves the counter on by one, and the server keeps track of where each user is. Time plays no part, so an unused code keeps working until a later one is used. If the device makes codes that are never used, the two counters drift apart, so the server looks ahead a few counts for a match: the look-ahead window. TOTP (time-based one-time password) uses the time instead, in steps of thirty seconds, so the code changes on its own whether or not anyone signs in. If the two clocks disagree, codes stop matching, so the server also accepts codes from a step or so either side of its own: the tolerance window. A quick test for each card: does the code move when a code is made, or when the clock moves?

What you'll learn

Tell HOTP from TOTP by what each combines with the shared key: a counter that moves with each code, or the current time step
Match each way of falling out of step to its protocol: HOTP's look-ahead window for counter drift, TOTP's tolerance window for clock skew

Aligned to

CompTIA Security+

4.6 Given a scenario, implement and maintain identity and access management.

NIST 800-53

IA-5 Authenticator Management

Key terms

HMAC-based One-time Password: HMAC-based One-time Password is an algorithm that generates a one-time code using HMAC-SHA1 and a counter value, used in hardware tokens for multi-factor authentication.
Time-based One-time Password: Time-based One-time Password generates short-lived authentication codes using HMAC and the current Unix time, widely used in authenticator apps as a second factor.
Counter Drift: A synchronization problem in HOTP where the client counter advances without a corresponding login, causing the client and server counters to fall out of sync.
Look-Ahead Window: A configurable tolerance in HOTP that allows the server to check a range of future counter values to compensate for counter drift.
Clock Skew: A time synchronization problem in TOTP where slight differences between the client and server system clocks can cause generated codes to not match.
Shared Secret Key: A cryptographic key known only to the authenticator app and the server, used as a common input to generate matching one-time passwords.

Topics

Authentication One Time Password Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →