AltF Authenticator

HOTP generator (RFC 4226)

HOTP makes a one-time code from a shared secret and a counter that goes up by one each time a code is used. Enter a Base32 secret and a counter value to see the code. It follows RFC 4226 exactly and runs in your browser.

  • Free, no sign-up
  • Secrets stay in your browser
  • RFC 6238 self-test built in
  • Works on mobile

How HOTP works

  • Write the counter as an 8-byte big-endian number.
  • Compute HMAC-SHA-1 of the counter with the shared secret, giving 20 bytes.
  • Take the low 4 bits of the last byte as an offset and read 4 bytes from there.
  • Clear the top bit, take the number modulo 10^6 and pad to 6 digits.

HOTP and TOTP

TOTP is HOTP with the counter replaced by the number of 30-second periods since 1 January 1970. HOTP codes do not expire on their own: a code stays valid until it, or a later one, is used. That makes HOTP useful for hardware tokens without a clock, but it also means an unused code stays useful to anyone who sees it.

Keeping the counter in step

Each time you press a token's button its counter goes up, even if you never type the code. The server keeps its own counter and checks a small look-ahead window of future values. When it finds a match it moves its counter past it. If a token is pressed many times without logging in, it can fall outside the window and needs to be resynchronised.

RFC 4226 test values

With the ASCII secret 12345678901234567890 (Base32 GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ), counters 0 to 9 give: 755224, 287082, 359152, 969429, 338314, 254676, 287922, 162583, 399871, 520489. Use them to check your own implementation.

HOTP generator (RFC 4226): questions and answers

Is HOTP less secure than TOTP?

Not in its maths. The practical difference is that HOTP codes stay valid until used, while TOTP codes expire after the period.

Can I use 8 digits or SHA-256 with HOTP?

RFC 4226 defines 6 to 8 digits with HMAC-SHA-1. Some systems use other hashes, but check that both sides agree.

Does the tool remember my counter?

No. You choose the counter each time, so keep track of the value your service expects.

Authenticator tools and 2FA guides

All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.

Guides

What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.Lost phone 2FA recoveryLost or reset the phone with your authenticator app? Steps to get back into accounts with backup codes or recovery, then set 2FA up safely again.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.

AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.