thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

HMAC-Based One-Time Password (HOTP)

OTP algorithm (RFC 4226) that generates codes from a shared secret and an incrementing counter.

Definition

HOTP codes remain valid until used, and the server tracks the counter with a look-ahead window to handle desynchronization. Because codes do not expire with time, an unused code can be valid for longer than a TOTP code. It is used in some hardware tokens.

Example

Pressing the button on a hardware token increments the counter and shows the next HOTP code.

Exam tip

HOTP = counter/event-based; TOTP = time-based.

Related terms