HOTP

HOTP generates one-time codes from a shared secret and an incrementing counter using an HMAC function. Unlike time-based codes, an HOTP code stays valid until it is used, which suits hardware tokens without clocks. It is the older sibling of TOTP and the foundation the TOTP standard builds on.

• Proton Pass → Open-source password manager from the Proton team with a built-in TOTP authenticator and email aliases. Storing codes beside passwords trades some separation of factors for convenience; know that tradeoff.

Affiliate links: the site may earn a commission at no extra cost to you (how this works). No single tool is a silver bullet; treat each as one layer of coverage.