Start With What "One-Time" Actually Means
A one-time password, almost always shortened to OTP, is a code that is valid for exactly one use, or for one short window of time, and then becomes permanently useless. Compare that to a normal password: type it into the wrong website, have it leaked in a data breach, or have it typed while a keylogger is running, and it keeps working until you notice and change it, which could be months. An OTP flips that risk profile entirely. Even if someone captures it the instant you type it, it is already worthless, because it either just got consumed or its window already closed. That single property, disposability, is the entire reason OTPs exist, and it is worth understanding that OTP is a broader category than the six-digit authenticator app code most people picture, which is really just one specific kind of OTP called TOTP (covered in depth in our TOTP guide).
Four Ways an OTP Actually Gets to You
TOTP, time-based: your authenticator app and the server both hold the same secret key, and both independently combine that secret with the current time, run it through a hash function, and produce the same six digits every 30 seconds. Nothing is transmitted to generate the code; it is computed locally on your device. This is the dominant method for app-based two-factor authentication today, and you can watch the mechanism live in our free TOTP generator.
HOTP, counter-based: instead of the clock, both sides track a counter that increments by one each time a code is generated and accepted. The code changes on use rather than on a timer, which is common in physical hardware tokens that have no reliable internal clock to stay synchronized. The practical trade-off against TOTP is detailed in our TOTP vs HOTP comparison.
SMS or email OTP: the service generates a code, stores it temporarily on its own server, and sends it to you over a text message or email rather than having your device compute it independently. This is the most familiar kind to most people because banks and shopping sites use it constantly, but it is also the weakest, because the delivery channel itself, the phone network's SS7 signaling, a SIM swap, or a compromised email inbox, can be intercepted or redirected without you noticing. Our SMS 2FA security analysis walks through exactly how those attacks work.
Push notification or app-approval OTP: instead of typing digits at all, the service sends a prompt to a trusted device asking you to approve or deny a login, sometimes alongside a number you match against what is shown on screen (called number matching, meant to stop a user from blindly approving a push they did not initiate). This still functions as a one-time credential, it is just delivered as an approval action instead of a typed string.
Ranking Them by What They Actually Resist
Putting the four side by side by what each one is genuinely resistant to:
- SMS and email OTP resist simple password guessing but not delivery-channel interception, and they resist nothing at all against real-time phishing, where a fake login page relays your code to the real site within seconds of you typing it.
- TOTP resists interception entirely, since nothing is transmitted to generate the code, and resists guessing because of the sheer number of possible six-digit combinations within a 30 second window combined with server-side rate limiting. It does not resist real-time phishing any better than SMS does, because a phishing site can still relay a stolen TOTP code within its short validity window.
- HOTP shares TOTP's resistance to interception and guessing, with one mild weakness: because the counter advances only on use rather than expiring on a clock, a generated-but-unused code can in principle remain valid longer than a TOTP code would, which is why servers commonly cap how far ahead of the last accepted counter value they will accept.
- Push notifications with number matching resist casual approval mistakes better than a plain "approve or deny" push, but remain vulnerable to a user who is socially engineered into approving a login they did not initiate, sometimes called MFA fatigue or push-bombing.
Nothing here is unbreakable. What genuinely closes the real-time phishing gap that all four OTP types share is a phishing-resistant method like a passkey, which cryptographically binds the login to the specific website's real domain so a fake copy cannot relay it. OTPs are a large improvement over a password alone; passkeys are a further improvement over OTPs specifically against phishing.
An OTP being boring and short-lived is not a limitation of the design, it is the entire design. A secret that stops mattering thirty seconds after it is issued is a secret not worth stealing in the first place.
OTP Is Not a Synonym for 2FA
It is easy to use the two terms interchangeably, but they describe different layers of the same idea. Two-factor authentication, 2FA, is the strategy: prove your identity using two different categories of evidence, typically something you know (your password) plus something you have (your phone, a hardware key). An OTP is a tool that frequently fills the second slot in that strategy. The distinction matters because not every OTP is used for 2FA (a one-time link emailed to reset a forgotten password is technically an OTP-adjacent mechanism used entirely on its own, with nothing else layered on top), and not every second factor is an OTP (a fingerprint or a hardware security key is a second factor without being a one-time code at all). The fuller breakdown of overlapping terms lives in our 2FA vs MFA post.
Where You Are Already Using OTPs Without Naming Them
The bank text confirming a wire transfer, the six digits from an authenticator app unlocking an email account, the "enter the code we just sent" step at online checkout, the login verification for a social media account after signing in from a new device: every one of these is a one-time password doing the identical job, proving momentarily that the person completing the action is who they claim to be, regardless of whether it arrived by text, by app, or by a tap on a push notification.
How a TOTP Code Actually Gets Computed
Since TOTP is the form most people interact with daily through an authenticator app, it is worth seeing the mechanism once. When you scan a 2FA setup QR code, your app receives a shared secret key, typically encoded in Base32 (explained in our Base32 guide). From that point on, every 30 seconds, the app takes that secret, combines it with the current Unix time divided into 30 second steps, and runs the combination through an HMAC hash function, truncating the result down to six digits. The server, holding the identical secret, performs the exact same calculation independently and compares its result to what you typed. Neither side ever transmits the code in advance for the other to check against; both compute it from the same starting secret and the same clock. The hashing step underneath is the same general family of one-way functions covered from first principles in our hashing guide.
Frequently Asked Questions
Is an OTP the same thing as two-factor authentication?
Not quite. An OTP is a tool, a disposable code; 2FA is the broader strategy of requiring two different types of proof to log in. A one-time password very often serves as the second proof in a 2FA setup, sitting alongside your regular password, but the two terms describe different layers and are not interchangeable. Our 2FA vs MFA post covers the related terminology in full.
Why do TOTP codes expire after only thirty seconds?
The short window is deliberate: long enough for a person to read and type six digits comfortably, short enough that a code intercepted or glimpsed by someone else is almost certainly already expired by the time they could try to use it. If your codes get rejected even though you typed them correctly, the usual cause is clock drift between your device and the server rather than the timing design itself, which our time sync troubleshooting guide walks through.
Which kind of OTP is the least secure, and why does it stay so common?
SMS OTP is the weakest of the four in terms of what it resists, since the delivery channel itself can be intercepted through SIM swapping or telecom-level attacks, and it offers no protection against real-time phishing. It remains extremely common because it requires no app installation and works on any phone that can receive a text, which is a real usability advantage that keeps it in wide use for lower-stakes logins even though TOTP or a passkey is stronger.
Can an OTP be reused if it was generated but never actually submitted?
A TOTP code simply stops being valid once its 30 second window closes, whether or not it was ever used. An HOTP code instead stays valid until the shared counter advances past it, which is the mild structural weakness mentioned above. In both systems, once a code has been successfully accepted by the server, that specific code is marked used and rejected on any subsequent attempt, which prevents straightforward replay.
Where does the original OTP secret come from in the first place?
The service generates the secret at setup time and shares it with you exactly once, embedded in the QR code you scan or as a manual setup key you can type in by hand instead (covered in our manual setup key guide). From that single exchange onward, your authenticator app and the server both hold an identical copy of that secret and independently generate matching codes without ever needing to communicate it again.
