OneTaskBy Tim King · Updated
HOTP Generator
RFC 4226 Counter-Based One-Time Passwords From a Base32 Secret
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the HOTP Generator works
Enter a base32 secret and a starting counter and this HOTP generator lists the one-time passwords for that counter and the ones after it. It follows RFC 4226 exactly, so you can check the output against a hardware token or your own server code.
How the HOTP generator works
HOTP signs an eight-byte counter with HMAC and the shared secret. It then takes the last four bits of the signature as an offset, reads four bytes from that position, clears the top bit and keeps the last six or eight decimal digits. Each time you use a code, both sides add one to the counter.
Keeping the counter in sync
Because the counter only moves when a code is used, a token that is pressed without logging in gets ahead of the server. Servers handle this with a look-ahead window: they try the next few counters and, on a match, jump forward. The table here lets you see that window and find which counter a code belongs to.
HOTP or TOTP?
HOTP suits hardware tokens and printed code lists where there is no clock. TOTP, which replaces the counter with the time, is what almost every authenticator app uses, because its codes expire on their own. If you are building something new for phone apps, choose TOTP.
FAQ
How do I check my implementation?
Use the RFC 4226 test secret — the ASCII string 12345678901234567890, which is GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ in base32. From counter 0 the codes should read 755224, 287082, 359152, 969429, 338314 and onward. If yours differ, check the byte order of the counter first.
Do HOTP codes expire?
Not by time. A code stays valid until a later counter has been accepted, which is the main weakness of HOTP compared with TOTP. Servers should reject any counter at or below the last one used so a code can never be replayed.
Why is the counter limited to whole numbers?
The counter is an unsigned 64-bit integer, sent as eight bytes in big-endian order. Fractions and negative numbers have no meaning, so the page rounds down and starts from zero if you enter anything else.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
TOTP Generator
Live two-factor codes from a base32 secret, with a countdown.
Otpauth URI Decoder
Break an otpauth:// 2FA link into issuer, secret and settings.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.
AES Key Generator
Random AES-128, 192 or 256-bit keys in hex, Base64 or JWK.