How Does an HMAC-Based One-Time Password (HOTP) Work?

An HMAC-based One-Time Password (HOTP) works by combining a secret key with a counter value to generate a unique, one-time password each time it is used.

When a user logs into a system with HOTP authentication enabled, the server and the client both have a copy of the shared secret key. The server also stores the current counter value.

When the user enters their password, the client increments the counter value and uses the HMAC algorithm to combine the secret key with the counter value to generate a unique password. This password is sent to the server for validation.

The server performs the same calculation using its stored counter value and secret key. If the generated password matches the one provided by the client, the authentication is successful.