HOTP One-Time Password Generator
HOTP One-Time Password Generator: Computes HMAC-SHA1 across 8-byte big-endian counter value and performs dynamic truncation.
About this hotp one-time password generator
HOTP One-Time Password Generator — browser-based utility.
How this tool works
Implements IETF RFC 4226 HMAC-Based One-Time Password algorithm. Given a shared secret and a 64-bit event counter, computes an HMAC digest, applies dynamic truncation using the lower 4 bits of the last byte as an offset, and emits a standardized 6-digit or 8-digit decimal authentication code.
- Token Structure Extraction: Splits JWT strings on '.' delimiters into Header, Payload, and Signature segments.
- Base64URL Decoding: Decodes URL-safe Base64 segments into raw JSON strings without executing unverified signature payloads.
- Claims Parsing & Timestamp Evaluation: Parses registered claims ('exp', 'nbf', 'iat', 'iss', 'aud') and checks current clock validity.
- Cryptographic Status Reporting: Displays token signature algorithm (RS256, HS256, ES256, EdDSA) and warns that client decoding does not verify cryptographic signatures without the public key.
Worked example
Scenario: A security engineer generates counter-based HMAC-Based One-Time Passwords (RFC 4226).
Sample input:
Processing: Computes HMAC-SHA1 across 8-byte big-endian counter value and performs dynamic truncation.
Illustrative output:
Limits and verification
Rejects strings that do not contain exactly two '.' delimiters. Explicitly informs the user that client-side decoding inspects token claims but CANNOT verify mathematical signature validity unless the corresponding public key/secret is supplied.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the HOTP One-Time Password Generator workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
How does HOTP Generator use the counter?+
It parses JSON secret, counter, and optional digits, then calculates an HMAC-SHA-1 HOTP code for that exact counter value.
What did the browser fixture verify?+
The RFC 4226 secret at counter 0 and six digits produced 755224.
Does HOTP advance or store the counter?+
No. It reads the supplied counter only and does not persist or increment it. The calling system must manage synchronization and replay prevention.
Can TOTP and HOTP codes be substituted?+
No. TOTP derives its counter from time while HOTP uses an explicit event counter. Both sides must use the same scheme and parameters.