What’s the Difference Between OTP, TOTP and HOTP?
#EP 30 | OTP, HOTP & TOTP: The Six‑Digit Codes Powering Secure Authentication
Just the other day, I was logging in and copied the six-digit code from my phone. I copied it, switched apps, and right when I was about to paste it—gone. Expired.
But that’s actually TOTP doing its job. These disappearing codes aren’t glitches; they’re part of the alphabet soup of authentication—OTP, HOTP, and TOTP—that quietly keeps your accounts safer. If you’ve ever wondered why some codes vanish in seconds while others stick around, here’s the story.
TL; DR for the Impatient
OTP (One-Time Password) = 🔑 Use once, then throw away
Adds a second layer of security beyond your password
HOTP (Counter-based OTP) = 🔢 Next token each time you ask
Like taking a numbered ticket; valid until used
TOTP (Time-based OTP) = ⏱️ Expires after 30–60 seconds
Like a countdown timer; short-lived, tighter security
Together =Both improve MFA security
HOTP = flexible but longer attack window
TOTP = stricter, faster expiry, more common today
What One-Time Passwords Actually Do
OTPs work exactly like they sound. Use once, discard. The next time you log in, you’ll need a fresh code. Simple idea, massive security upgrade.
Companies across every industry face the same problem:
How do you give users simple access without making it simple for attackers?
Multi-factor authentication adds a second credential beyond your password. That text message code you type in? That’s an OTP in action.
The beauty is in the disposability. Once you’ve used that password, it’s worthless. Next login, you get a new one. Makes life considerably harder for anyone trying to break into your accounts.
You’ll find OTPs delivered three ways: smartphone apps, text messages, or hardware tokens like key fobs. Duo Mobile and Google Authenticator are app examples. That SMS code landing in your messages? Also, an OTP.
How the Magic Happens
Behind the scenes, algorithms like SHA-1 generate these codes using two inputs: a seed and a moving factor. The seed is a secret key created when you set up your account. It stays the same forever.
The moving factor changes with each new code request. How it changes is what separates HOTP from TOTP.
HOTP: The Counter-Based Approach
HMAC-based One-Time Password works like a counter. Each time you use a code, the counter moves to the next number—like taking a token and moving to the next turn.
The code stays valid until you use it, and the authentication server confirms access. No time limit. You can generate one, get distracted, come back twenty minutes later, and it still works.
YubiKey’s hardware tokens use this method. The device and server stay synced through that counter mechanism.
The tradeoff? That extended validity window creates a longer attack surface. If someone intercepts your code, they’ve got more time to exploit it. Some HOTP implementations now add time-based components to close this gap, which blurs the line between the two approaches.
TOTP: The Clock-Based Alternative
Time-based One-Time Password swaps the counter for a clock. Each code lives for a timestep, typically 30 or 60 seconds. Miss that window and you’ll need to generate a new one.
This is what you’re seeing in Google Authenticator, Authy, and most authenticator apps. That countdown timer isn’t decorative. It’s your code’s lifespan.
The upside? Tighter security. Even if someone grabs your code, they’ve got seconds to use it, not an open-ended window.
The downside? Time-drift. There’s lag between when the password generates and when you actually type it in. Type too slowly or have a phone clock that’s slightly off, and you might enter an expired code. Good servers account for this with a grace period and let you try again without locking you out.
TOTP is newer and easier to implement. Most users understand the countdown timer model at this point.
Which One Wins?
Both beats using no MFA at all. Both beat SMS by a significant margin.
Here’s the problem with text message codes: scammers intercept them. SIM card fraud, SS7 attacks, and other exploits give bad actors access to your texts. An authenticator app generating codes locally on your device is substantially harder to compromise.
If you’re still relying on SMS for multi-factor authentication, you’re doing better than nothing. But you’re leaving security on the table. Hardware tokens and authenticator apps close vulnerabilities that SMS leaves wide open.
For most implementations, TOTP makes sense. Users recognize the pattern, servers can handle the time-drift edge cases, and the security gains justify the occasional expired code frustration.
Next time that six-digit number vanishes before you finish typing, remember it’s working as designed. Keeping your accounts marginally safer in a world where password123 still shows up in breach reports.
P.S. If you’re building authentication flows, go with TOTP. Users expect the countdown timer at this point, and the security payoff beats the occasional “code expired” complaint. Just make sure your server logic accounts for time-drift. Nobody enjoys getting locked out because their phone thought it was three seconds ahead.
P.P.S. We’re testing new cold brew ratios this week. Two were disasters. One was transcendent. Results drop Tuesday—because we test everything before we ship it.
Slow apps killing your projects? Grab my Cache Rules Everything: A Developer’s Guide to Faster Applications for pro caching techniques that 10x speed. Get it now. Peek at my top 3 optimization hacks for more dev wins!
Creators: Want to reach an engaged audience of developers? Email me at souravb.1998@gmail.com for collaboration or sponsorship opportunities.
Help Us Shape Core Craft Better
TL; DR: Got 2 minutes? Take this quick survey to tell us who you are, what you care about, and how we can make Core Craft even better for you.
Thank You for Reading!
Loved this? Hit ❤️ to share the love and help others find it!
Get weekly tech insights to code smarter and build your dev career. Subscribe to Core Craft for practical tips and frameworks you can use today.
Have ideas or questions? Drop a comment—I reply to all! For collabs or newsletter sponsorships, email me at souravb.1998@gmail.com
Solid breakdwon on the time-drift problem with TOTP. I ran into this exact issue when implementing auth for a global app where users had devices with inconsistent time sync. The grace period approach is smart but the realy fix was validating against ±1 timestep window instead of just current. Most devs dunno this but RFC 6238 actually recommends checking adjacent windows to handle that lag. Saved us from a ton of false lockouts.