Two Sibling Standards Behind One-Time Passwords
Nearly all software two-factor authentication traces back to two open OATH/IETF RFC documents: RFC 4226 (HOTP, introduced in 2005) and RFC 6238 (TOTP, introduced in 2011). Both use the exact same HMAC cryptographic core, yet their moving input could not be more different.
Time-Based (TOTP) vs. Counter-Based (HOTP)
In HOTP (HMAC-Based One-Time Password), the input moving factor is an incrementing integer event counter (0, 1, 2, 3...). In TOTP, that manual counter is replaced by UTC wall-clock intervals (30 or 60 seconds).
| Dimension | HOTP (RFC 4226) | TOTP (RFC 6238) |
|---|---|---|
| Moving Factor | Synchronized event counter incremented per press | Current Unix timestamp divided by time step (30s/60s) |
| Expiration | Valid indefinitely until used or overtaken by later code | Automatically expires after 30 or 60 seconds |
| Synchronization Issue | Counter desync if user clicks button without logging in | Clock drift if device system time drifts too far |
| Multi-Device Copies | Difficult—pressing on Phone A desyncs Laptop B | Seamless—every synced device shows the exact same code |
| Typical Hardware/Software | Button-press hardware key fobs without internal clocks | Google Authenticator, Secure TOTP, Authy, 1Password |
Practical Examples of Where Each Fits
When HOTP Makes Sense
Physical credit-card-sized or keychain tokens without an internal battery-backed clock rely on HOTP. Pressing the physical button generates the next code in sequence—ideal when the device cannot keep UTC time for 5+ years.
Why Modern Web Logins Standardized on TOTP
Smartphones and desktop computers already maintain accurate UTC clocks. Switching the counter to time solves HOTP's biggest pain point: multi-device usability. If you keep the same token in your phone app and inside Secure TOTP Authenticator in Chrome both tools stay permanently synchronized without stepping on each other's counters.
While older apps supported only SHA-1, modern RFC 6238 software implementations—including Secure TOTP—support SHA-1, SHA-256, and SHA-512 over both 30s and 60s periods.
