Cybersecurity glossary
What is a One-Time Password (OTP)?
Learn what a one-time password is, how SMS, email, HOTP, and TOTP OTPs work, why OTPs are phishable, and when to prefer FIDO passkeys over OTP-based MFA.
Definition
A one-time password (OTP) is a short-lived authentication code valid for a single use or brief window, generated by an algorithm or delivered out-of-band, and commonly used as a second factor alongside a primary credential.
Why one-time codes became ubiquitous MFA
Static passwords fail constantly. One-time passwords (OTPs) add a moving secret that is harder to reuse after theft—delivered by SMS, email, hardware token, or authenticator app.
OTPs raised the floor for consumer and enterprise MFA. They did not close the phishing gap.
OTP delivery and generation models
SMS / voice OTP
Convenient, but exposed to SIM swap, carrier attacks, and malware reading texts.
Email OTP
Depends on mailbox security; often too long-lived in poorly built flows.
TOTP apps
Shared-seed codes that rotate with time; common and offline-friendly.
HOTP tokens
Counter-based codes from hardware or software generators.
Transaction codes
OTPs tied to a specific operation such as a payment approval.
Magic-link hybrids
Single-use links are OTP cousins delivered in URLs.
Typical OTP verification flow
Primary authentication succeeds
Password or another first factor identifies the account.
OTP is generated or sent
Server creates a code or the user’s token computes the next value.
User submits the code
Typed into a form or automated by an approved client channel.
Server validates
Checks match, expiry, attempt counts, and single-use status.
Session continues
Access is granted; the OTP should no longer be reusable.
Strengths and residual risks
| Aspect | Upside | Downside |
|---|---|---|
| Password reuse attacks | Blocks many stuffing takeovers | Falls if OTP also phished |
| Offline TOTP | Works without SMS delivery | Seed theft clones the generator |
| User familiarity | Easy to roll out widely | Trains users to type codes anywhere |
| High-risk admins | Better than password alone | Inferior to FIDO2/passkeys |
Hardening checklist
- Expire OTPs quickly and enforce single-use consumption.
- Rate-limit generation and validation; detect spraying across accounts.
- Prefer TOTP or better over SMS for workforce MFA when FIDO is unavailable.
- Never log OTPs in plaintext application or analytics logs.
- Protect TOTP/HOTP seed storage as credential material.
- Avoid leaking account existence through OTP error messages.
- Plan migration to phishing-resistant authenticators for privileged users.
- Treat OTP recovery and resend flows as sensitive authentication paths.
The practical takeaway
An OTP is a disposable code that strengthens authentication beyond static passwords. It remains widely useful—and widely phishable.
Use OTPs to raise baseline assurance, harden delivery and verification, and move high-value accounts toward FIDO2/passkeys that do not ask users to type secrets into forms.
Related security terms
Time-Based One-Time Password (TOTP)
Time-window OTP algorithm used by authenticator apps.
Hash-Based One-Time Password (HOTP)
Counter-based OTP algorithm used by many hardware tokens.
Multi-Factor Authentication (MFA)
Broader MFA category where OTPs are a common second factor.
Phishing-Resistant MFA
Stronger alternative when OTP phishing is an unacceptable risk.
SIM Swapping
Attack that undermines SMS OTP delivery channels.
Frequently asked questions
What is an OTP in simple terms?
It is a temporary code—usually 6 digits—you use once to prove you control a phone, email inbox, or authenticator app during login.
What types of OTP exist?
Common types include SMS or email codes, voice codes, TOTP authenticator apps, HOTP hardware tokens, and some proprietary push-adjacent codes.
Are OTPs passwords?
They function as short-lived secrets. Unlike long-term passwords, a correctly implemented OTP should expire quickly and not reuse values.
Why can OTPs be phished?
Users can type a valid OTP into a fake website or give it to a caller. Attackers relay the code to the real site in real time.
Is authenticator-app OTP safer than SMS?
Usually yes against SIM swap and SS7 issues, but both remain phishable because codes are still typed by humans.
When should OTPs still be used?
As a better-than-password-only control, for step-up on medium-risk actions, or where FIDO is not yet available—while planning a phishing-resistant upgrade path.
What operational controls matter for OTP?
Rate limits, short expiry, single use, device binding where possible, monitoring for spraying, and careful recovery design.
References
Explore authoritative guidance and frameworks related to one-time password (otp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.