⏱️TOTP

NEW

Also known as: Time-based One-Time Password

A time-synchronized one-time password algorithm that generates short-lived codes for user authentication.

DESCRIPTION

TOTP is standardized in RFC 6238 and builds on HOTP by incorporating time steps to produce short-lived codes. It’s widely used as a second factor via authenticator apps and tokens. Security depends on managing shared secrets, preventing phishing, and handling clock synchronization. While convenient, TOTP is vulnerable to real-time phishing and man-in-the-middle attacks compared to FIDO2/WebAuthn.

ALTERNATIVE DEFINITIONS

IETF

This document describes an algorithm for generating one-time passwords based on a time factor.

Formal standard specifying the time-based OTP algorithm and parameters.

Source

Wikipedia

Time-based one-time password (TOTP) is a temporary passcode generated by an algorithm that uses the current time as a source of uniqueness.

Plain-language overview highlighting time-bound uniqueness.

Source

Auth0

Authenticator apps implement TOTP to generate verification codes that expire after a short period.

Practical context for deploying TOTP in MFA flows.

Source

RELATED TERMS

Multi-Factor Authentication FIDO2 Authenticator App Shared Secret QR Code Provisioning Clock Drift Phishing Man-in-the-Middle Attack

COMPETING TERMS

HOTP WebAuthn

KNOWLEDGE AREAS

Data Security Software Engineering Platform & Tooling

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer DevOps Engineer IT Manager

EXTERNAL SOURCES

• Wikipedia - Time-based One-Time Password
• IETF - Official TOTP algorithm standard
• IETF - HOTP algorithm standard
• Google Developers - Auth flows and OTP context

TOP QUESTIONS

How does TOTP differ from HOTP?

TOTP uses time steps, while HOTP uses a counter. TOTP codes expire quickly, enhancing security against replay.

Category: Comparison

What are common mistakes with TOTP deployment?

Poor secret storage, lack of clock synchronization, and inadequate UX for backup codes can lead to failures and account lockouts.

Category: Mistakes

Is TOTP phishing-resistant?

No, TOTP codes can be phished and relayed in real time. WebAuthn/FIDO2 offer stronger phishing resistance.

Category: Security

How is TOTP provisioned to users?

Typically via QR codes encoding secrets and parameters, used by authenticator apps to generate time-based codes.

Category: Implementation

What are best practices for TOTP?

Protect shared secrets, enforce rate limiting, monitor failed attempts, and offer secure recovery mechanisms.

Category: Best practices

Can TOTP be used as a primary factor?

It is generally used as a second factor; as a primary factor, its security is weaker than passwordless public-key methods.

Category: Opinion

How should clock drift be handled in TOTP?

Allow a small window of past/future time steps and ensure server and client times are synchronized.

Category: Requirements

What is the typical code length for TOTP?

Six digits are common, but implementations can choose other lengths based on policy and risk.

Category: Definition

Which apps support TOTP?

Popular authenticator apps include Google Authenticator, Microsoft Authenticator, and Authy, among others.

Category: Example