What TOTP means
TOTP means time-based one-time password. It uses a shared secret and the current time step, usually 30 seconds, to produce the current authenticator code.
Time-Based vs Counter-Based Authenticator Keys
Choose time-based when the setup uses TOTP or an otpauth://totp/ URI. Choose counter-based only when the service explicitly uses HOTP and maintains a synchronized counter. The two modes can share a secret format but do not generate interchangeable codes.
What HOTP means
HOTP means HMAC-based one-time password. Instead of time, it uses a counter that changes after each generated or accepted code.
Time-based vs counter-based: the practical difference
TOTP codes expire as time moves forward, while HOTP codes depend on counter synchronization between the client and the server. If a HOTP counter drifts, resynchronization may be needed.
Authenticator app defaults
Most modern authenticator app setup screens and otpauth://totp/ QR codes use TOTP with SHA-1, 6 digits, and a 30-second period unless another parameter is shown.
What this tool supports
This site is focused on TOTP setup keys for 2FA and MFA. It does not generate HOTP counter codes, SMS codes, email codes, push approvals, or recovery codes.
Time-based vs counter-based authenticator comparison
The setup type determines the moving value used to calculate each one-time password. Match the service's mode; changing only the secret cannot convert HOTP into TOTP.
| Compare | Time-based (TOTP) | Counter-based (HOTP) |
|---|---|---|
| Moving value | Current time step, commonly 30 seconds | Synchronized counter that advances |
| Provisioning URI | otpauth://totp/ | otpauth://hotp/ with a counter |
| When the code changes | When the time window changes | When the counter advances |
| Common failure | Clock, period, digits, or algorithm mismatch | Client and server counters drift apart |
| Support on this site | Supported for Base32 and otpauth TOTP setup data | Not supported because a server counter is required |
Standards and references
- RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm
- RFC 6238: TOTP: Time-Based One-Time Password Algorithm
- Google Authenticator Key URI Format
FAQ
Is Google Authenticator TOTP or HOTP?
Read the provisioning type rather than relying on the app name. otpauth://totp/ is time-based; otpauth://hotp/ is counter-based. Most current QR setup flows use TOTP, while this web tool supports only TOTP setup data.
Can I use a HOTP secret in this TOTP generator?
No. HOTP requires a counter value, while this generator calculates time-based TOTP codes. Use a HOTP-capable tool if the service explicitly provides a HOTP setup.
Why do most 2FA codes change every 30 seconds?
That is the common TOTP period. The code is derived from the shared secret and the current time window, so it changes when the time window changes.
How can I tell if an otpauth link is TOTP?
A TOTP provisioning link usually starts with otpauth://totp/. A HOTP provisioning link usually starts with otpauth://hotp/ and includes counter-related behavior.