TOTP vs HOTP Explained: One-Time Passwords for the Security+ Exam

TOTP and HOTP are the two algorithms behind almost every authenticator app and hardware token you will encounter. They generate one-time passwords — the six-digit codes you type after your password — and the difference between them comes down to a single design decision.

HOTP codes change when you use them. TOTP codes change when the clock does.

Both are open standards, both use HMAC with a shared secret, and both produce the same kind of short numeric code. The distinction is what goes into the hash alongside the secret: a counter, or the time.

HOTP — HMAC-Based One-Time Password

Defined in RFC 4226. The server and the token share a secret key and a counter. To generate a code, both sides compute an HMAC-SHA-1 of the secret and the current counter value, then truncate the result to six or eight digits.

The counter increments only when a code is generated or used. A code stays valid until it is consumed, which may be minutes or days later.

That creates the characteristic HOTP problem: counter desynchronization. If a user presses the button on a hardware token a few times without submitting the codes, the token's counter runs ahead of the server's. Servers handle this with a look-ahead window, typically accepting codes from the next 10 to 20 counter values and resynchronizing when one matches. Drift beyond the window means the token must be re-enrolled.

TOTP — Time-Based One-Time Password

Defined in RFC 6238, and built directly on HOTP. Instead of a counter, the moving value is the number of time steps elapsed since the Unix epoch — normally 30-second steps. Both sides compute the same value because both know the time.

Codes expire automatically whether used or not, which is the security advantage. An intercepted code is worthless within half a minute.

TOTP's failure mode is the mirror of HOTP's: clock drift. If the device's clock is wrong by more than a step or two, codes are rejected. Servers typically accept the previous and next time step to allow for skew and slow typing, and the practical fix for a user is to correct the device's time — which is why "check the date and time settings on your phone" is the standard first troubleshooting step.

Side by Side

	HOTP	TOTP
Standard	RFC 4226	RFC 6238
Moving factor	Event counter	Time step, usually 30 seconds
Code lifetime	Until used	Expires automatically
Sync problem	Counter drift	Clock drift
Needs accurate time	No	Yes
Exposure window	Long	Short
Typical use	Hardware tokens, offline devices	Authenticator apps, most modern MFA

TOTP is the modern default — Google Authenticator, Microsoft Authenticator, Authy, and the vast majority of "scan this QR code" enrolments are TOTP. HOTP survives where a device has no reliable clock or no battery to run one.

What They Share, Including the Weaknesses

Both are shared-secret schemes. The server stores the same seed the token holds, which means a breach of the authentication database exposes the seeds and every code derived from them. Compare this with public-key approaches such as FIDO2 and passkeys, where the server holds only a public key and a breach yields nothing usable.

Both are also phishable. This is the important point and the one exams increasingly test. A user who types a code into a convincing fake site hands the attacker a working credential, and a real-time proxy can relay it to the genuine service within the validity window. One-time passwords defeat password reuse and credential stuffing; they do not defeat a competent phishing operation.

Phishing-resistant MFA means FIDO2, WebAuthn, passkeys, or certificate-based authentication — methods cryptographically bound to the legitimate domain. If a question asks for phishing-resistant MFA, TOTP is not the answer.

Security+ (SY0-701) Exam Tips

• Know the expansions and the moving factor for each. HOTP = HMAC-based, counter. TOTP = time-based, 30-second window.
• TOTP requires synchronized clocks; HOTP does not. The classic discriminator.
• Codes not being accepted? Clock drift for TOTP, counter desync for HOTP.
• Both are "something you have" in the authentication factor model — the device holding the seed.
• Neither is phishing-resistant. Expect a question where FIDO2 or a hardware security key is the correct answer over an authenticator app.
• SMS-based codes are weaker still, vulnerable to SIM swapping and interception. Know the hierarchy: SMS < TOTP/HOTP < push with number matching < FIDO2.
• Shared secrets are the structural weakness of both.

CySA+ and A+ Angles

CySA+ (CS0-004) looks at it operationally: detecting MFA fatigue and push-bombing, recognizing real-time phishing proxies in logs, and recommending phishing-resistant methods after an incident.

A+ (220-1201/1202) keeps it practical — enrolling a user in an authenticator app, and troubleshooting rejected codes by checking the device clock.

Key Takeaways

• HOTP uses a counter; TOTP uses the clock. That is the whole difference.
• TOTP codes expire in about 30 seconds whether used or not; HOTP codes wait to be used.
• HOTP drifts on counters, TOTP drifts on clocks, and each has a tolerance window.
• TOTP is the modern default for authenticator apps.
• Both are shared-secret and both are phishable.
• Phishing-resistant MFA means FIDO2, WebAuthn, or passkeys, not one-time passwords.