+1 coinfor reading to the end
+1
Home / Glossary / HOTP
Glossary · Security

HOTP

HMAC-based One-time Password

In plain language

A one-time sign-in code that comes from a counter, so each code works once.

The metaphor

Like a ticket book where each ticket is numbered and valid once, and the venue knows which number comes next.

Going deeper

How it works

  • The device and server share a secret and a counter.
  • Each press creates the next code.
  • A used code cannot be used again.
  • If the counter drifts, the server needs a resync.

How WILDCARD handles it

Cloud covers sign-in settings, including two-factor, in your Microsoft 365 or Google workspace.

In practice
  • A hardware key fob shows a six-digit code when pressed.
  • An older VPN asks for a code from a token.
  • A system resyncs after many unused presses.

A question owners ask

How is it different from the code in my phone app?

App codes change with the clock. These change with each use.

Where WILDCARD handles this
Cloud
Start with Cloud
Related terms
AAAAuthentication, Authorization, and AccountingACLAccess Control ListAdmin accountAESAdvanced Encryption StandardAES-256Advanced Encryption Standards 256-bitAIArtificial IntelligenceAPIApplication Programming InterfaceBiometrics

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →