ffee All tools
EN 中文 FR DE

HOTP Generator

Counter Based One Time Codes — computed locally in your browser.

Generate HOTP codes

A secret made only of digits, like the RFC test vectors, is used as plain text. Base32 secrets need at least one letter.
Code for counter 0: —
RFC 4226 test vectors: not run
Codes for the next ten counters
HOTP codes stay valid until the counter moves, so pair them with a short server side window.

How to use the HOTP Generator

  1. Enter the Base32 secret, or paste the ASCII secret from the RFC test vectors.
  2. Set the counter and choose six or eight digits.
  3. Read the current code and the codes for the next ten counters.

Features

Advertisement

More tools

Password Strength Checker Text Encrypt and Decrypt HMAC Generator Base32 Encoder Base58 Encoder Base85 Encoder XOR Cipher RSA Encrypt and Decrypt File Encryptor ROT47 Cipher Text to Binary Cipher Salt Generator

Frequently Asked Questions

Common questions about the free online hotp generator.

HOTP is the counter based one time password algorithm from RFC 4226, where both sides keep a counter and move it forward after every successful code.
The counter is hashed with the secret using HMAC-SHA1, then a dynamic truncation step extracts a value that is reduced to six or eight digits.
TOTP replaces the moving counter with the current time step, so its codes expire on their own instead of waiting for the counter to change.
It accepts a Base32 secret as used by authenticator apps, and it also accepts a plain text secret such as the digits used in the RFC test vectors.
The tool verifies the published test vectors, where the secret 12345678901234567890 gives 755224 at counter 0 and 287082 at counter 1.
If a user generates a code but never submits it, the counters drift apart, so servers usually accept a small look ahead window.
A correct server records the last accepted counter and refuses any code that maps to an earlier counter, which blocks replay attacks.
Six digits is the common default. Eight digits lowers the chance of a lucky guess but only works with clients that support it.
No. Every code is computed locally with the Web Crypto API and nothing is sent anywhere.

Last updated: October 10, 2026