This article is overall a nice breakdown of how TOTP/HOTP function. My only concern is that it seems to connect the “counter” (time in the case of TOTP) with sa

This article is overall a nice breakdown of how TOTP/HOTP function. My only concern is that it seems to connect the “counter” (time in the case of TOTP) with salting. Salting of passwords is targeted towards a totally different problem. The HMAC functions here don’t take a salt, they take a secret and what the RFC calls a “moving factor”. It exists intentionally to allow the resulting calculation to change over time in unpredictable (to an attacker) ways.