HOW IT WORKS
TOTP vs HOTP: time-based and counter-based codes
TOTP and HOTP both produce short authentication codes. Their main difference is the moving value used to calculate each one.
What changes the code?
| Setting | TOTP | HOTP |
|---|---|---|
| Moving value | Time interval | Event counter |
| Next code | At the next interval | When the counter advances |
| Setup type | otpauth://totp/ | otpauth://hotp/ |
| In 2FAOrbit | Supported | Not supported |
Choose what the service specifies
An authenticator has to match the service’s configuration. Changing the setup link from HOTP to TOTP does not convert the account. If you have a counter-based setup, use an authenticator that supports it.
Inspect before importing
Our setup link inspector tells you when a link uses an unsupported format. For a standard TOTP link, it shows the algorithm, digits and period so you can understand the configuration before using it.
References: RFC 4226: HOTP and RFC 6238: TOTP.