A one-time password (OTP) is a temporary, single-use code used to verify a user’s identity, typically as a second authentication factor. Because each code works only once and expires quickly, an OTP is harder to reuse than a static password. But it carries its own well-known weaknesses.

OTPs are everywhere: the six-digit code texted during login, generated by an authenticator app, or emailed to confirm an action. They’re familiar and easy to deploy, which is both their strength and the reason their limitations are so widespread.

How OTPs are delivered

• SMS/email OTP, the code is sent to the user’s phone or inbox. Convenient, but exposed to SIM swapping, interception, and phishing.
• TOTP (time-based OTP), an authenticator app generates a code from a shared seed and the current time, refreshing every 30 seconds. No delivery channel to intercept, but still phishable.
• HOTP (counter-based OTP), similar, but based on an incrementing counter rather than time.

The core weakness: OTPs are phishable

Any OTP the user reads and types can be captured. Real-time phishing sites and proxies trick users into entering their code on a fake page, then relay it to the real site instantly, defeating the OTP entirely. SMS OTPs add SIM-swap and interception risks on top. This is why OTPs, while far better than a password alone, are no longer considered strong protection for high-value accounts.

OTPs vs. phishing-resistant methods

The industry is moving from OTPs toward phishing-resistant authentication (passkeys/FIDO2), where there’s no code to phish because the proof is cryptographic and origin-bound. OTPs still have a place (as a step-up factor, for lower-risk flows, or where device constraints rule out passkeys) but treating an OTP as a strong control is increasingly a mismatch with how attackers actually operate.

Where OTPs still make sense

For all their weaknesses, OTPs aren’t obsolete everywhere, and it’s worth being precise about where they hold up. As a step-up factor for a moderate-risk action, an OTP still raises the bar over nothing. For lower-risk consumer services without the stakes of banking, TOTP or number-matched push is a reasonable baseline. And OTPs provide broad coverage (they work on almost any device, with no special hardware) which matters for reaching customers who can’t or won’t use passkeys.

The mistake is using an OTP where it’s specifically targeted: guarding money movement, protecting account recovery, or standing as the sole factor on a high-value account. Those are exactly the places real-time phishing and SIM-swap attacks concentrate. The pragmatic stance is to prefer phishing-resistant methods as the default, keep OTPs as a fallback and step-up option rather than a primary control, and never let an OTP be the only thing between an attacker and a sensitive action. Positioned that way, OTPs remain useful; positioned as strong security, they’re a liability.

Frequently asked questions

What does OTP stand for?

One-time password.

Are one-time passwords secure?

They’re better than static passwords but phishable; SMS OTPs also face SIM-swap and interception risks.

What’s the difference between OTP and TOTP?

TOTP is a type of OTP generated from a shared seed and the current time, refreshing periodically.

What’s more secure than an OTP?

Phishing-resistant methods like passkeys, where there’s no code to intercept or phish.

Related: Time-Based OTP (TOTP) · SMS OTP / SMS 2FA · Multi-Factor Authentication (MFA) · Passkeys · Magic Link Authentication