Identity & Access
HMAC-Based One-Time Password (HOTP)
Also known as: RFC 4226, Event-based OTP
Definition
An event-based one-time password algorithm defined in RFC 4226 that derives a short code from a shared secret and a monotonically increasing counter.
Examples
- A YubiKey configured in HOTP mode emitting a new 6-digit code on each button press.
- Paper-based backup codes issued by a corporate VPN portal.
Related terms
One-Time Password (OTP)
A short numeric code that is valid for only a single login attempt or a brief time window, typically used as a second authentication factor.
Time-Based One-Time Password (TOTP)
A one-time password algorithm defined in RFC 6238 that derives a short code from a shared secret and the current time, rotating every 30 seconds.
Multi-Factor Authentication (MFA)
An authentication method that requires two or more independent factors — typically from different categories — before granting access.
Two-Factor Authentication (2FA)
A specific form of multi-factor authentication that requires exactly two factors — usually a password plus a second factor — to verify identity.
HMAC
A keyed Message Authentication Code construction built on top of a cryptographic hash function, defined in RFC 2104 and FIPS 198-1.
FIDO2
FIDO2 — definition coming soon.