Two-Factor CodesTOTP and HOTP: the difference
Both make the same kind of code. The difference is what changes between one code and the next.
HOTP: a counter
HOTP (RFC 4226, 2005) uses a counter. Each time you press the button on a hardware token, or ask the app for a new code, the counter goes up by one. The server keeps its own counter. If you press the button several times without logging in, your counter runs ahead of the server's, so the server must check a window of the next few counters (the RFC calls this the look-ahead window) and then move its counter forward. RFC 4226 also asks for a user-friendly way to resynchronize the counter.
TOTP: the time
TOTP (RFC 6238, 2011) replaces the counter by the number of time steps since 1970. Nothing has to be pressed and nothing runs ahead, but the clocks must agree. The RFC recommends a step of 30 seconds, and that the verifier accept at most one step of network delay, which is why the previous or next code may also work.
| HOTP | TOTP | |
|---|---|---|
| What changes | A counter, when a code is used | The time, every step |
| Can run out of step | Yes, if codes are made but not used | Yes, if the clock is wrong |
| Typical use | Hardware tokens with a button | Authenticator apps |
| A code is valid for | Until used (within the window) | One step, plus allowed drift |
Which one do apps use?
Authenticator apps almost always use TOTP. Many of them can also hold HOTP entries. The setup address (otpauth://totp/... or otpauth://hotp/...) says which one it is. Use the tester on the home page to see both.
Which is safer?
They have the same strength when the secret is kept safe. TOTP codes expire on their own, which limits how long a stolen code is useful.
Can I switch from one to the other?
No. The server decides, and the secret is set up again.
Sources
- RFC 4226 (rfc-editor.org/rfc/rfc4226), requirements R5 and R6 and the look-ahead window
- RFC 6238 (rfc-editor.org/rfc/rfc6238), time-step size and validation sections
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.