TOTP
acronymsecuritycryptography
Stands for: Time-based One-Time Password
A one-time code that changes every 30 seconds, used for two-factor auth.
Time-based One-Time Password (RFC 6238) derives a short code from a shared secret and the current time using HMAC, so authenticator apps and servers compute the same value independently. It is the basis of most app-based 2FA.
TOTP is the six digits from an authenticator app, and the mechanism is simpler than most people assume. The server and the device share a secret established once at enrolment, both know the current time, and both compute the same HMAC over the current time window. Nothing is transmitted between them, which is why it works on a phone in airplane mode.
The time window explains every quirk. Codes usually last thirty seconds, servers typically accept the adjacent window to tolerate clock drift and slow typing, and a device whose clock has drifted badly will produce codes that are correct for a moment nobody else is in. Clock skew is the first thing to check when a user swears their app is broken.
The important limit is what TOTP does not defend against. It stops password reuse and credential stuffing outright, because a stolen password no longer completes a login. It does not stop real-time phishing: a proxy that relays the code as the user types it is inside the window and the code is still valid. That is the gap hardware keys close by verifying the site's origin, and it is why TOTP is a large improvement rather than a final answer.
Also known as: totp