HOTP Generator
Generate HOTP one-time passwords for any counter from a Base32 secret, with SHA-1/256/512 and 6–8 digits. Lists upcoming codes; RFC 4226 vectors verified.
The key shown by the service when you set up 2FA. Spaces and lowercase are fine.
HOTP (RFC 4226): HMAC of the 8-byte counter with the secret, dynamic truncation, then modulo 10^digits. The server and the token each keep a counter that advances with every code used.
Runs entirely in your browser. Your data is never uploaded.
What is HOTP Generator?
HOTP produces a new one-time password each time a counter increases, as used by YubiKey OATH-HOTP and some hardware tokens. This tool computes the code for any counter value and lists the following codes so you can resynchronise or test a server.
How to use HOTP Generator
- Paste the Secret key (Base32) or click New random secret.
- Set Algorithm and Digits.
- Enter the Counter and how many Codes to show.
- Copy the first code or read the table of counter → code.
Example
Secret GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ, SHA-1, 6 digits, counter 0
755224 (then 287082, 359152, 969429, 338314 for counters 1–4)
RFC 4226 Appendix D test values.
When to use HOTP Generator
Use it to test HOTP implementations, resynchronise a token's counter or learn how one-time passwords are derived. For time-based codes used by most apps, use the TOTP generator.
How HOTP Generator works
HOTP(K, C) = Truncate(HMAC(K, C)) mod 10^digits, where C is the 8-byte big-endian counter. Dynamic truncation takes 4 bytes starting at the offset given by the low 4 bits of the last HMAC byte and clears the top bit. HMAC is computed with the Web Crypto API; all RFC 4226 Appendix D values are reproduced.
Common Use Cases
- Testing an HOTP login implementation
- Finding the counter of a desynchronised hardware token
- Reproducing RFC 4226 test values
- Teaching the dynamic truncation step
FAQs
What is the difference between HOTP and TOTP?
HOTP uses an event counter that increases with every code; TOTP uses the current time divided by a period as the counter.
What happens if the counter gets out of sync?
Servers usually accept a look-ahead window of a few counter values and then resynchronise to the matching one.
Which secret format is expected?
Base32 (RFC 4648), the same format that otpauth:// URIs and authenticator setup screens use.