A time-based one-time password (TOTP) is a temporary authentication code generated using a shared secret key and the current time. TOTP codes are typically generated by an authenticator application or hardware token and remain valid for a short period, commonly around 30 seconds.
TOTP is a type of one-time password (OTP) and is commonly used as an authentication factor in multi-factor authentication (MFA). Unlike SMS OTP, TOTP codes are generated locally and do not need to be delivered over the mobile network for each authentication event.
TOTP authentication uses a shared secret and time-based algorithm.
During enrolment:
During authentication:
Because the code changes automatically with time, a previously used TOTP is normally not valid indefinitely.
A TOTP code is a short, temporary numeric code generated by an authenticator application or hardware token.
A common implementation produces a six-digit code that changes at regular intervals, although the exact length and validity period can vary by implementation.
OTP is the broader category; TOTP is one specific type of OTP.
An OTP can be generated or delivered using several methods, including SMS, email, push or an authenticator application.
A TOTP is specifically generated using:
Shared secret + current time → temporary authentication code
This means every TOTP is an OTP, but not every OTP is a TOTP.
| TOTP | SMS OTP |
|---|---|
| Generated locally by an authenticator | Delivered through SMS |
| Uses a shared secret and time | Uses a temporary code sent to a mobile number |
| Does not depend on SMS delivery for each code | Depends on mobile network delivery |
| Reduces exposure to SIM-swap-based SMS interception | Can be exposed to SIM swap and number-porting attacks |
| Can still be phished | Can be phished |
| Requires an authenticator app or compatible device | Works on almost any mobile phone capable of receiving SMS |
TOTP can therefore address some of the security and availability limitations associated with SMS OTP, but it does not make authentication phishing-resistant by itself.
TOTP can be more resistant to some threats than SMS OTP, particularly threats involving interception of SMS messages or control of a mobile number.
However, TOTP is still a shared secret that the customer enters into an authentication interface. A phishing attacker can potentially capture the code and use it before it expires.
Security therefore depends not only on how the OTP is generated but also on the surrounding authentication architecture.
TOTP reduces certain risks but does not eliminate authentication threats.
A customer can be tricked into entering a valid TOTP into a fraudulent website or application.
Because TOTP codes have a short validity period, attackers may attempt to capture and immediately relay them to the legitimate service.
The security of TOTP depends on protecting the shared secret established during enrolment. If the secret is compromised, an attacker may be able to generate valid codes.
If the authenticator device or application is compromised, the TOTP factor may also be at risk.
An attacker who compromises the process used to enrol, replace or recover an authenticator can potentially bypass the security of TOTP itself.
TOTP is commonly used as one factor within multi-factor authentication. For example:
Password + TOTP = MFA
The password represents a knowledge factor, while the TOTP can provide an additional possession-related factor when generated through a user's authenticator device.
However, MFA strength depends on the independence and resistance of the factors involved. Adding a TOTP does not automatically make an authentication flow resistant to phishing or social engineering.
TOTP is not passwordless authentication.
TOTP removes the need for a user to receive or remember a static authentication code, but the user still enters a temporary secret into the authentication process.
Passwordless approaches such as passkeys and FIDO2 authentication instead use cryptographic credentials designed to authenticate the user without transmitting a reusable secret to the service.
TOTP can be combined with contextual and risk signals to create a more resilient authentication architecture.
Financial institutions can evaluate:
This supports risk-based authentication, where the level of authentication friction can be adjusted according to the assessed risk.
For example, a familiar customer using a trusted device for a routine action may present substantially less risk than an unfamiliar device attempting a high-value transaction immediately after an unusual account change.
TOTP can be useful where an organisation needs:
However, organisations should evaluate TOTP against the threats, user journey and assurance requirements of each use case.
For high-risk authentication, phishing-resistant methods and contextual risk assessment may provide stronger protection than relying on TOTP alone.
TOTP can be used in digital banking and other financial services to authenticate:
For payment authentication, the appropriate authentication method depends on the payment environment, applicable regulatory requirements, risk assessment and authentication architecture.
TOTP and passkeys solve different authentication problems.
TOTP uses a temporary code generated from a shared secret and time.
Passkeys use public-key cryptography and are designed to authenticate without requiring the customer to enter a shared password or OTP code.
TOTP can therefore be considered a stronger alternative to some SMS OTP use cases, while passkeys represent a fundamentally different approach to authentication.
TOTP is a time-based form of one-time password authentication that removes the need to deliver each code by SMS, reducing some risks associated with mobile-network delivery. However, TOTP codes can still be phished or captured in real time, so TOTP should be considered one component of a broader authentication strategy rather than a complete fraud-prevention solution.
What is TOTP?
➡️ TOTP stands for Time-Based One-Time Password. It is a temporary authentication code generated using a shared secret and the current time.
How does TOTP work?
➡️ An authenticator and the service independently calculate a temporary code from the same secret and current time. The authentication succeeds when the codes match within the permitted time window.
Is TOTP more secure than SMS OTP?
➡️ TOTP can reduce risks associated with SMS interception, SIM swaps and mobile-network delivery, but it can still be vulnerable to phishing and real-time attacks.
Is TOTP an OTP?
➡️ Yes. TOTP is a specific type of one-time password.
What is the difference between TOTP and OTP?
➡️ OTP is the broader category of temporary authentication codes. TOTP is generated specifically using a shared secret and the current time.
What is the difference between TOTP and SMS OTP?
➡️ TOTP codes are generated locally by an authenticator, while SMS OTP codes are delivered through the mobile network.
Can TOTP be hacked?
➡️ TOTP can be compromised through attacks such as phishing, real-time interception, device compromise or compromise of the shared secret.
Can TOTP be phished?
➡️ Yes. A user can be tricked into entering a valid TOTP into a fraudulent website, allowing an attacker to capture the code.
Is TOTP passwordless?
➡️ No. TOTP is an authentication factor based on a temporary secret. Passwordless authentication uses methods such as passkeys that do not require users to enter passwords or OTP codes.
Is TOTP suitable for banking?
➡️ TOTP can be used for banking authentication, but financial institutions should assess it alongside the required security assurance, fraud risks, customer experience and applicable regulatory requirements.
What is better than TOTP?
➡️ There is no universal replacement. Depending on the use case, passkeys, device-based authentication, biometrics, push authentication, behavioural intelligence and risk-based authentication can provide different security and usability advantages.