TOTP and HOTP
Time-based one-time passwords.
TOTP and HOTP is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
One-Time Passwords
A One-Time Password (OTP) is a code valid for a single login or a short window.
Two standard algorithms generate them: HOTP and TOTP.
The Shared Secret
Both algorithms start from a shared secret known only to the server and your authenticator app.
It is usually delivered as a QR code during setup and stored on both sides.
HOTP: Counter-Based
HOTP (HMAC-based OTP) combines the shared secret with a counter using HMAC, then truncates the result to a short numeric code.
The counter increments by one with each generated code.
HOTP = Truncate( HMAC-SHA1(secret, counter) )TOTP: Time-Based
TOTP (Time-based OTP) is HOTP where the counter is the current time divided into fixed steps (usually 30 seconds).
Because time always moves forward, both sides stay in sync without tracking a manual counter.
T = floor( (current_unix_time) / 30 )
TOTP = Truncate( HMAC-SHA1(secret, T) )The 30-Second Window
A TOTP code typically changes every 30 seconds. That short lifetime limits how long a stolen code is useful.
This is why authenticator apps show a countdown bar.
Clock Skew Tolerance
Device clocks drift slightly. To avoid rejecting valid codes, servers accept codes from one step before and after the current window.
Too wide a window weakens security, so it is kept small.
HOTP Synchronization
HOTP can drift if a generated code is not used (counter advances on the device but not the server).
Servers allow a small look-ahead window to resync, but large gaps require manual resynchronization.
The otpauth URI
QR codes encode an otpauth URI describing the secret and parameters.
otpauth://totp/Example:alice@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example&period=30Why TOTP Won
TOTP is far more common than HOTP because:
- No counter to drift or resync.
- Codes naturally expire on their own.
- It works offline; no network needed to generate a code.
Strengths and Limits
TOTP is a big upgrade over passwords alone, but it is still phishable: a fake site can trick a user into typing a live code.
Hardware keys (covered next lesson) resist this.
Backup and Recovery
Losing the device that holds the secret can lock you out. Good practice:
- Save the recovery codes issued at setup.
- Back up the secret securely or register a second authenticator.
Quick Check
What is the key difference between HOTP and TOTP?
Recap
You learned how OTP algorithms work.
- Both build on a shared secret and HMAC.
- HOTP uses a counter; TOTP uses time.
- TOTP codes expire every ~30 seconds but remain phishable.
- Keep recovery codes.
Next, we explore push approvals and hardware keys.
Frequently asked questions
Is the “TOTP and HOTP” lesson free?
Yes — the full text of “TOTP and HOTP” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “TOTP and HOTP”?
Time-based one-time passwords. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “TOTP and HOTP” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.