OTP vs TOTP
One Is the Category, the Other Is the Method
These aren't competitors. OTP is the general idea of a single-use code; TOTP is the specific implementation where the code is derived from the current time and changes every thirty seconds. The other implementation, HOTP, uses a counter instead. If you're using an authenticator app, you have TOTP.
The Relationship in One Line
Every TOTP code is an OTP. Not every OTP is a TOTP.
OTP describes what the code does: it works once, then it's spent. TOTP describes how it's produced: from a shared secret plus the current time. See What is OTP? for the general concept.
Asking "OTP or TOTP" is a bit like asking "vehicle or car". The useful comparison is between the two ways of building one.
The Two Implementations
Both start from the same shared seed. They differ only in the moving value combined with it.
| HOTP (counter-based) | TOTP (time-based) | |
|---|---|---|
| Moving value | A counter, incremented per code | The current time, in 30-second windows |
| Standard | RFC 4226 | RFC 6238 |
| Code expires | ❌ No - valid until used | ✅ Yes - every 30 seconds |
| Needs a synced clock | ✅ No | ❌ Yes, roughly |
| Can fall out of sync | ❌ Yes, if codes are generated but unused | ✅ No - time never desynchronises |
| Common today | Rare, some banking tokens | Virtually universal |
| Main weakness | A generated code stays valid indefinitely | A 30-second window is ample for a relay attack |
Why TOTP Won
Three reasons, and they compound.
Codes expire on their own. An HOTP code generated and never used remains valid indefinitely - a screenshot from last year still works. A TOTP code is dead in thirty seconds whether you use it or not.
No counter to desynchronise. HOTP breaks in a specific and annoying way: press the button a few times without submitting anything, and your counter runs ahead of the server's. Servers compensate by checking a window of upcoming values, but push far enough and the token needs resynchronising. Time has no such problem - both sides read the same clock.
Nothing to store. A TOTP implementation doesn't have to persist a counter that must stay consistent, which makes it far simpler to get right in software and hardware alike.
Which One Do You Have?
Almost certainly TOTP.
You have TOTP if your code changes on its own every thirty seconds, usually with a countdown ring. Every authenticator app works this way, and so does a Seedkeeper PRO - see What is TOTP?.
You have HOTP if you press a button on a small dedicated token and the code sits there until you use it. These are still issued by some banks and older enterprise systems.
Neither if the code arrives by SMS or email. Those are one-time passwords delivered over a channel rather than generated locally, and they carry an entirely different risk - see SMS vs TOTP.
What Neither of Them Fixes
Both are one-time passwords, so both share the same two structural limits.
The seed is a shared secret, held by you and the service. If the service's copy leaks, an attacker can generate your codes without touching your device.
And both are information you read and type, which means both can be relayed by a convincing fake page in real time. See Passkey vs OTP.
Choosing TOTP over HOTP is choosing the better of two good options. Choosing a passkey where one is offered is choosing a different category.
FAQ
What is the difference between OTP and TOTP?
OTP is the general concept of a single-use code. TOTP is the specific implementation where the code is derived from a shared secret and the current time, changing every thirty seconds. Every TOTP code is an OTP.
What is the difference between HOTP and TOTP?
HOTP derives the code from a counter that increments with each use, so the code stays valid until used. TOTP derives it from the current time, so it expires automatically. TOTP is what almost every authenticator implements today.
Which is more secure, HOTP or TOTP?
TOTP, in practice. Its codes expire on their own, so a code captured and never used becomes worthless within thirty seconds, whereas an unused HOTP code can remain valid indefinitely.
How do I know which type my authenticator uses?
If the code changes by itself on a countdown, it is TOTP. If it only changes when you press a button and then stays put, it is HOTP.