SimSmsBox Quick answer: TOTP and HOTP are the two algorithms behind those six-digit authenticator codes. HOTP (HMAC-based OTP) uses a counter that ticks up by one every time a code is generated, so a code stays valid until it’s used. TOTP (time-based OTP) is the same idea with the counter replaced by the clock, so the code rotates every 30 seconds. Nearly every authenticator app you’ve used is TOTP; HOTP mostly lives on in hardware key fobs.
If you’ve ever wondered why an authenticator code expires in half a minute while an old bank key fob’s number waits patiently until you type it, you’re looking at the difference between TOTP and HOTP. They share the same DNA but disagree on one thing: what drives the counter. Here’s what that changes in practice, and how it relates to the codes you receive by SMS OTP.
1. Same secret, different counter
Both algorithms start from a shared secret — a random key stored on your device and on the server. To make a code, they run that secret through an HMAC hash together with a moving number, then truncate the result to six digits. The only real difference is where the moving number comes from:
- HOTP uses an event counter. Each generated code advances it by one. Code #47 is valid until someone uses it; then the server expects #48.
- TOTP uses time. It divides the current Unix time into 30-second windows and uses the window number as the counter. When the window rolls over, the code changes on its own.
That’s it. TOTP is literally HOTP with a clock wired into the counter slot.
2. The practical differences
| Factor | HOTP (counter) | TOTP (time) |
|---|---|---|
| What moves the code | A button press / event | The clock, every 30s |
| How long a code lasts | Until it’s used | ~30 seconds |
| Needs synced clocks | No | Yes (device + server) |
| Risk if code is stolen | Valid until redeemed | Expires fast |
| Typical home | Hardware tokens | Authenticator apps |
The short-lived nature of TOTP is why it won: a stolen code is nearly useless within a minute. HOTP’s open-ended validity is more forgiving of clock drift, but a leaked code sits there waiting to be used.
3. Where you actually meet each one
Open Google Authenticator, Authy, or a password manager’s built-in codes and you’re using TOTP — that’s the modern default, and it’s the same mechanism compared against SMS in our authenticator app vs SMS codes guide. HOTP tends to show up in dedicated hardware: bank card readers, older RSA-style fobs, and some FIDO fallback devices, where there’s no reliable clock to trust.
Neither one is delivered over the phone network. That’s the key contrast with SMS OTP, where the code is generated server-side and sent to you — which is exactly why SMS codes can be received on an online number while TOTP/HOTP codes cannot.
4. What this means if you receive codes online
TOTP and HOTP are computed from a secret that lives on your device — there’s nothing to intercept over a network, so there’s also nothing an online number can help with. If a service only offers an authenticator-app setup, an SMS-receiving service isn’t part of that flow at all.
SMS OTP is the opposite: the secret is one-time and travels to a phone number, which is why receiving codes online without a SIM works for it. When a site lets you choose between “authenticator app” and “text me a code,” the SMS option is the one that a received-online number can complete.
FAQ
Q: Is TOTP more secure than HOTP? For most uses, yes — the 30-second expiry sharply limits how long a stolen code is useful. HOTP’s advantage is only that it doesn’t need a synced clock.
Q: Why does my authenticator code sometimes get rejected right as it changes? Clock drift. If your phone’s time is off by more than the server’s tolerance window, TOTP codes fail. Enabling automatic network time usually fixes it.
Q: Can I receive a TOTP code by SMS? No. TOTP is generated locally from a secret; it’s never sent. Only SMS OTP is delivered to a phone number.
Takeaway
TOTP and HOTP are the same algorithm with a different clock: HOTP counts events and waits, TOTP counts seconds and expires. Both are device-generated secrets, so neither travels over the phone network — that remains the exclusive job of SMS OTP, the only code you can actually receive on an online number.