Cybersecurity glossary
What is Time-Based One-Time Password (TOTP)?
Learn what TOTP is, how authenticator apps generate time-based codes, how TOTP differs from HOTP and SMS, phishing limits, and secure enrollment practices.
Definition
Time-Based One-Time Password (TOTP) is an algorithm that generates short numeric codes from a shared secret and the current time step, defined in RFC 6238 and widely implemented by authenticator apps as a second authentication factor.
Why authenticator apps standardized on time
Hardware counters desynchronize; SMS gets swapped. TOTP gave organizations a practical middle path: a shared seed and a clock produce matching codes offline in an app millions of people already understand.
It remains the most common software MFA—and a stepping stone toward passkeys.
How TOTP codes are produced
Provision a shared secret
Usually via QR code encoding an otpauth URI during MFA enrollment.
Divide time into steps
Typically 30-second windows derived from Unix time.
Run HOTP-style HMAC
Compute HMAC over the time-step counter using the shared secret.
Truncate to digits
Dynamic truncation yields a 6–8 digit code displayed to the user.
Server verifies with skew window
Accept current step and small ±N neighbors; reject reused codes.
Strengths and limits
| Aspect | Strength | Limit |
|---|---|---|
| Delivery | No SMS channel | Phone malware can still read codes |
| Offline use | Works without network | Needs roughly correct device clock |
| Phishing | Better than passwords alone | Codes are relayable in real time |
| Seed handling | Simple enrollment | QR/seed theft clones the factor |
Operational building blocks
Encrypted seed storage
Treat server-side TOTP secrets like password hashes’ cousins—highly sensitive.
Tight skew windows
Balance usability with replay surface.
Single-use enforcement
Reject a code that was already accepted in its window.
Rate limiting
Stop online guessing of 6-digit spaces.
Secure enrollment
Show QR only after primary auth; avoid logging otpauth URIs.
Backup codes
Provide audited recovery—not SMS fallbacks that undo MFA.
Hardening checklist
- Protect TOTP seeds at rest and during enrollment display.
- Enforce short time steps, small skew, and one-time code consumption.
- Rate-limit verification and alert on spraying.
- Do not fall back to SMS for users who enrolled TOTP if policy can avoid it.
- Offer migration paths to passkeys for privileged accounts.
- Invalidate TOTP on suspected seed exposure and require re-enrollment.
- Educate users not to read codes aloud to callers or enter them on unexpected sites.
- Keep recovery codes hashed/stored safely and audited on use.
The practical takeaway
TOTP is the time-based OTP algorithm behind authenticator apps. It improves on SMS and static passwords but still asks humans to type phishable codes.
Use it as solid baseline MFA, harden seeds and verification, and graduate high-risk users to origin-bound authenticators whenever you can.
Related security terms
Hash-Based One-Time Password (HOTP)
Counter-based predecessor algorithm TOTP builds on.
One-Time Password (OTP)
Broader OTP category that includes TOTP.
Multi-Factor Authentication (MFA)
MFA deployments that commonly use TOTP apps.
Phishing-Resistant MFA
Stronger alternative when TOTP phishing is unacceptable.
Passkey
Modern phishing-resistant replacement path for many TOTP users.
Frequently asked questions
What is TOTP in simple terms?
Your authenticator app and the server share a secret. Every 30 seconds they independently compute the same 6-digit code from the current time so you can prove you have the app.
Which RFC defines TOTP?
RFC 6238 defines TOTP: Time-Based One-Time Password Algorithm.
How does TOTP differ from HOTP?
HOTP uses a counter; TOTP uses time steps. TOTP codes change automatically without pressing a button.
Is TOTP safer than SMS OTP?
Generally yes against SIM swap and carrier attacks, but both remain phishable because users can type codes into fake sites.
Why do clocks matter?
Server and device must agree on time within an allowed window. Large skew causes valid codes to fail or widens acceptance windows dangerously.
What if the TOTP seed is stolen?
Attackers can generate every future code. Protect enrollment QR codes and encrypted seed backups.
Should new programs still choose TOTP?
As a transitional MFA yes; for privileged users prefer FIDO2/passkeys. Keep TOTP better than passwords-only while you migrate.
References
Explore authoritative guidance and frameworks related to time-based one-time password (totp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.