HOTP / Counter-Based OTP Generator

Generate an HOTP one-time password in your browser from any base32 shared secret and a numeric counter — the spec (RFC 4226) that TOTP is built on. Type a secret, set the counter, read the code. The look-ahead table shows the next 10 codes so you can recover if you missed an increment. Paste an otpauth://hotp/ URI to import, copy one back out to load into another device. The secret and the codes never leave this tab.

Settings

Counter & secret increment / decrement to advance the server-side counter
Counter
—

—

Codes click a code to copy · the first row is the current counter
Counter Code Action
Type a secret to compute codes.
About HOTP and this tool
  • HOTP (RFC 4226) is a counter-based one-time password: an HMAC of an 8-byte big-endian counter, dynamically truncated to 6 digits. Each press of the +1 button advances the counter by 1, mirroring what the server does.
  • TOTP (RFC 6238) is HOTP with the counter replaced by floor(unix_seconds / 30). This tool is the explicit-counter variant — useful when the server tracks an event index instead of a wall-clock window.
  • The shared secret is the base32 string the account issuer gave you. This tool does the exact same HMAC math, so the codes match what the server expects.
  • Algorithm: HMAC-SHA-1 is what 99% of services use; SHA-256 and SHA-512 are allowed by RFC 4226 but rarely seen. Match what your account issuer expects.
  • Look-ahead window (RFC 4226 §7.2): if you and the server disagree on the current counter by up to 10, the server will still accept one of the codes in the table. The +1 button is the same idea — the next 10 codes are precomputed, so if the server is ahead of you, just increment until a code matches.
  • Web Crypto: the actual HMAC is computed in your browser via crypto.subtle.sign("HMAC", key, counterBytes). The key is imported once per (secret, algorithm) pair and cached.
  • otpauth:// URIs are the standard way to move secrets between apps. Paste URI imports one (label, issuer, secret, algorithm, digits, counter all populate). Copy URI exports the current account so you can load it into another device.
  • Storage: nothing is saved to localStorage, cookies, or any server. Refresh the page and the secret + counter are gone — that's the privacy guarantee.
  • Threat model: anyone who can see your screen can copy the current code, so don't leave the tab open on a shared device. The secret itself is sensitive — treat it like a password.
  • Not a vault. This is a code generator, not a credential manager. For long-term storage use a password manager with a built-in authenticator (1Password, Bitwarden, etc.).