Time-based one-time passwords (TOTP)

A time-based one-time password (TOTP) is a temporary authentication code generated using a shared secret key and the current time. TOTP codes are typically generated by an authenticator application or hardware token and remain valid for a short period, commonly around 30 seconds.

TOTP is a type of one-time password (OTP) and is commonly used as an authentication factor in multi-factor authentication (MFA). Unlike SMS OTP, TOTP codes are generated locally and do not need to be delivered over the mobile network for each authentication event.

How does TOTP work?

TOTP authentication uses a shared secret and time-based algorithm.

During enrolment:

1. The service generates or establishes a shared secret key.
2. The secret is securely provisioned to the user's authenticator application or hardware token.
3. The service and authenticator use the same secret to generate TOTP values.

During authentication:

1. The authenticator calculates a code using the shared secret and current time.
2. The customer enters the code into the service.
3. The service independently calculates the expected code.
4. If the submitted code matches within the permitted time window, the authentication factor is accepted.

Because the code changes automatically with time, a previously used TOTP is normally not valid indefinitely.

What is a TOTP code?

A TOTP code is a short, temporary numeric code generated by an authenticator application or hardware token.

A common implementation produces a six-digit code that changes at regular intervals, although the exact length and validity period can vary by implementation.

TOTP vs OTP: what is the difference?

OTP is the broader category; TOTP is one specific type of OTP.

An OTP can be generated or delivered using several methods, including SMS, email, push or an authenticator application.

A TOTP is specifically generated using:

Shared secret + current time → temporary authentication code

This means every TOTP is an OTP, but not every OTP is a TOTP.

TOTP vs SMS OTP

TOTP can therefore address some of the security and availability limitations associated with SMS OTP, but it does not make authentication phishing-resistant by itself.

Is TOTP more secure than SMS OTP?

TOTP can be more resistant to some threats than SMS OTP, particularly threats involving interception of SMS messages or control of a mobile number.

However, TOTP is still a shared secret that the customer enters into an authentication interface. A phishing attacker can potentially capture the code and use it before it expires.

Security therefore depends not only on how the OTP is generated but also on the surrounding authentication architecture.

What are the security risks of TOTP?

TOTP reduces certain risks but does not eliminate authentication threats.

• Phishing

  A customer can be tricked into entering a valid TOTP into a fraudulent website or application.

• Real-time attacks

  Because TOTP codes have a short validity period, attackers may attempt to capture and immediately relay them to the legitimate service.

• Secret-key compromise

  The security of TOTP depends on protecting the shared secret established during enrolment. If the secret is compromised, an attacker may be able to generate valid codes.

• Device compromise

  If the authenticator device or application is compromised, the TOTP factor may also be at risk.

• Recovery and enrolment attacks

  An attacker who compromises the process used to enrol, replace or recover an authenticator can potentially bypass the security of TOTP itself.

TOTP and MFA

TOTP is commonly used as one factor within multi-factor authentication. For example:

Password + TOTP = MFA

The password represents a knowledge factor, while the TOTP can provide an additional possession-related factor when generated through a user's authenticator device.

However, MFA strength depends on the independence and resistance of the factors involved. Adding a TOTP does not automatically make an authentication flow resistant to phishing or social engineering.

TOTP vs passwordless authentication

TOTP is not passwordless authentication.

TOTP removes the need for a user to receive or remember a static authentication code, but the user still enters a temporary secret into the authentication process.

Passwordless approaches such as passkeys and FIDO2 authentication instead use cryptographic credentials designed to authenticate the user without transmitting a reusable secret to the service.

How can banks strengthen TOTP authentication?

TOTP can be combined with contextual and risk signals to create a more resilient authentication architecture.

Financial institutions can evaluate:

• Device identity
• Device reputation
• Customer behaviour
• Login history
• Session behaviour
• Network and location signals
• Transaction characteristics
• Account activity
• Indicators of automation
• Known fraud patterns

This supports risk-based authentication, where the level of authentication friction can be adjusted according to the assessed risk.

For example, a familiar customer using a trusted device for a routine action may present substantially less risk than an unfamiliar device attempting a high-value transaction immediately after an unusual account change.

When should TOTP be used?

TOTP can be useful where an organisation needs:

• An alternative to SMS-based OTP
• An authenticator-app-based second factor
• Authentication that does not depend on mobile network delivery
• A relatively simple MFA implementation
• A temporary authentication code generated locally

However, organisations should evaluate TOTP against the threats, user journey and assurance requirements of each use case.

For high-risk authentication, phishing-resistant methods and contextual risk assessment may provide stronger protection than relying on TOTP alone.

TOTP and financial services

TOTP can be used in digital banking and other financial services to authenticate:

• Customer logins
• Sensitive account changes
• Access to applications
• High-risk actions
• Administrative activity
• Other protected workflows

For payment authentication, the appropriate authentication method depends on the payment environment, applicable regulatory requirements, risk assessment and authentication architecture.

TOTP vs passkeys

TOTP and passkeys solve different authentication problems.

TOTP uses a temporary code generated from a shared secret and time.

Passkeys use public-key cryptography and are designed to authenticate without requiring the customer to enter a shared password or OTP code.

TOTP can therefore be considered a stronger alternative to some SMS OTP use cases, while passkeys represent a fundamentally different approach to authentication.

Key takeaway

TOTP is a time-based form of one-time password authentication that removes the need to deliver each code by SMS, reducing some risks associated with mobile-network delivery. However, TOTP codes can still be phished or captured in real time, so TOTP should be considered one component of a broader authentication strategy rather than a complete fraud-prevention solution.

FAQs

What is TOTP?
➡️ TOTP stands for Time-Based One-Time Password. It is a temporary authentication code generated using a shared secret and the current time.

How does TOTP work?
➡️ An authenticator and the service independently calculate a temporary code from the same secret and current time. The authentication succeeds when the codes match within the permitted time window.

Is TOTP more secure than SMS OTP?
➡️ TOTP can reduce risks associated with SMS interception, SIM swaps and mobile-network delivery, but it can still be vulnerable to phishing and real-time attacks.

Is TOTP an OTP?
➡️ Yes. TOTP is a specific type of one-time password.

What is the difference between TOTP and OTP?
➡️ OTP is the broader category of temporary authentication codes. TOTP is generated specifically using a shared secret and the current time.

What is the difference between TOTP and SMS OTP?
➡️ TOTP codes are generated locally by an authenticator, while SMS OTP codes are delivered through the mobile network.

Can TOTP be hacked?
➡️ TOTP can be compromised through attacks such as phishing, real-time interception, device compromise or compromise of the shared secret.

Can TOTP be phished?
➡️ Yes. A user can be tricked into entering a valid TOTP into a fraudulent website, allowing an attacker to capture the code.

Is TOTP passwordless?
➡️ No. TOTP is an authentication factor based on a temporary secret. Passwordless authentication uses methods such as passkeys that do not require users to enter passwords or OTP codes.

Is TOTP suitable for banking?
➡️ TOTP can be used for banking authentication, but financial institutions should assess it alongside the required security assurance, fraud risks, customer experience and applicable regulatory requirements.

What is better than TOTP?
➡️ There is no universal replacement. Depending on the use case, passkeys, device-based authentication, biometrics, push authentication, behavioural intelligence and risk-based authentication can provide different security and usability advantages.