# hotp

Source: https://startwithidentity.com/glossary/hotp/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant methods.

HOTP is mostly of historical interest now, but the counter model still shows up in hardware tokens and legacy banking devices. Its practical weakness beyond phishability is desynchronization: if the token advances without the server seeing it, the two drift apart and need a resync window, which is itself an attack surface. Time-based codes replaced it, and origin-bound credentials are replacing those.

See also: [TOTP](https://startwithidentity.com/glossary/totp/), [MFA](https://startwithidentity.com/glossary/mfa/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [MFA vendors](https://startwithidentity.com/vendors/mfa/)