HOTP generator
Counter-based one-time password (RFC 4226), computed on your device. The secret never leaves your browser.
Runs on your device. The file is never uploaded.
HOTP generator derives a one-time code from a shared secret and a counter you type, following RFC 4226. The counter starts at 0 and has to be a non-negative whole number, while digits default to 6 and the HMAC hash to SHA-1. Nothing advances the counter for you, so two runs at one value repeat the code.
Questions
How is this different from the TOTP tool?
HOTP is counter-based, from RFC 4226, and TOTP is time-based, from RFC 6238. Here you type the counter yourself and it defaults to 0; nothing advances it for you. TOTP generator computes the same HMAC construction, but derives its counter from the clock as floor(unix time / period). Everything else, the secret handling, the digits and the hash choices, is shared between them.
What is the counter?
A non-negative whole number that both sides agree on, incremented by one each time a code is used. Anything else is refused with "counter must be a non-negative whole number". The tool does not remember the last value you used, so you have to track it yourself. Enter the same counter twice and you get the same code twice.
What format does the secret take?
base32 by default, or plain text if you switch the format option. base32 input has whitespace, hyphens and trailing = padding stripped, and must then be A to Z and 2 to 7 only. Any other character is refused by name, with a nudge about 0, 1, 8 and 9 being mistyped for O, I, B and g. A secret that decodes to nothing gives "secret decoded to zero bytes".
Which digits and algorithms are supported?
1 to 10 digits, default 6, refused otherwise with "digits must be a whole number 1-10". The HMAC hash can be SHA-1, SHA-256 or SHA-512, defaulting to SHA-1, which is what RFC 4226 uses and what most hardware tokens expect. All of these must match the other side exactly, or the codes will not agree.
Does my secret get uploaded or saved?
No. The HMAC is computed by crypto.subtle in a Web Worker in this tab, and the secret lives in page memory only for the length of the run. Nothing is sent, nothing is stored, and the site works offline. This is a calculator, not a token store, so do not treat the page as somewhere a seed is kept.