Glossary
TOTP (time-based one-time password) is a one-time code generated on a device (usually an authenticator app) from a shared secret and the current time, refreshing at short intervals (typically every 30 seconds). It’s the code behind apps like the common authenticator tools, and a stronger second factor than SMS.
TOTP improved on SMS OTP by removing the delivery channel: the code is computed locally on the user’s device, so there’s no text message to intercept or SIM to swap.
At setup, the service and the authenticator app share a secret seed (often via a QR code). From then on, both sides independently compute the same code from that seed plus the current time, using a standard algorithm. When the user enters the code shown in their app, the server computes the expected value and compares. Because both derive it from synchronized time, no code needs to be transmitted from server to user.
TOTP still shares the fundamental OTP flaw: the user reads a code and types it, so a real-time phishing site can capture it and relay it within its 30-second window. It resists the passive attacks SMS is prone to, but not active real-time phishing. That’s why TOTP is a solid step up from SMS yet still short of phishing-resistant methods like passkeys. For many services it’s a reasonable second factor; for high-value accounts, phishing-resistant options are preferable.
What does TOTP stand for?
Time-based one-time password.
Is TOTP more secure than SMS OTP?
Yes. It isn’t exposed to SIM swapping or interception, though it remains phishable in real time.
How often does a TOTP code change?
Typically every 30 seconds.
Can TOTP be phished?
Yes, a real-time phishing site can capture and relay the code within its valid window.
What replaces TOTP for stronger security?
Phishing-resistant methods like passkeys, where there’s no code to read and relay because the proof is cryptographic and origin-bound.
Related: One-Time Password (OTP) · SMS OTP / SMS 2FA · Multi-Factor Authentication (MFA) · Passkeys
