Glossary

#one-time password #two-factor authentication #multi-factor authentication #phishing defense

What is a one-time password (OTP)? TOTP vs HOTP vs SMS, and its limits

A one-time password (OTP) is a code valid once and only briefly. TOTP vs HOTP vs SMS, why it beats leaked passwords, and why live phishing can defeat it.

Published 2026-07-02 Updated 2026-10-06 8 min read

On this page

A one-time password (OTP) is a single-use, disposable code. Here are the types and a limit people often miss: phishing can still defeat it (no attack steps).

The types: TOTP / HOTP / SMS-OTP

They all get lumped together as "disposable codes," but they split into three by how they're generated.

TOTP (time-based)

The app computes it from a shared secret + the current time. Rotates about every 30s. Works offline.

HOTP (counter)

Advances by a count, not time. Each press gives the next code. Used by hardware tokens.

SMS-OTP

Sends the code by SMS. Convenient but weak to SIM swaps and relaying — the frailest method.

The three main OTP methods. Strength comes down to 'can you hand it to a fake site?'

All share the "single-use, short-lived" nature, so even if a fixed password leaks, the code itself is hard to reuse. TOTP especially is computed inside the app without any network round-trip, so it has no interception path like SMS does.

Strengths and limits: a fake site can steal what you type

OTP patches the weaknesses of fixed passwords, but it isn't complete protection. The decisive limit is that a human reads and types the code.

Where OTP works

stops takeovers from leaked / reused passwords
even if seen, it's invalid quickly and hard to reuse
authenticator-app TOTP works offline and resists interception better than SMS

Where OTP breaks

adversary-in-the-middle (AiTM) phishing: a fake site relays the OTP to the real one and logs in
SIM swapping: hijack the phone number and siphon the SMS-OTP
root cause = a human can hand the code to a fake site (it isn't bound to the domain)

How the delivery method changes the risk

"One-time password" covers several methods, and the weak points depend on where the code is made and how it reaches you.

Method	Where the code is made	How it reaches you	Main weak points
Authenticator app (TOTP)	On your phone	It doesn't travel (computed on the device)	Typing it into a fake site, recovery after losing the phone
Hardware token	A small dedicated device	It doesn't travel (shown on its screen)	Typing it into a fake site, losing the device
SMS	The service's server	The mobile phone network	Typing it into a fake site, SIM swaps, SMS interception
Email	The service's server	Email	Typing it into a fake site, email account takeover

The weak point every method shares is being typed into a fake site. The US National Institute of Standards and Technology (NIST) authentication guideline SP 800-63B (revision 4, August 2025) says manually entered one-time passwords can't be phishing-resistant, and treats methods that use the phone network, such as SMS, as "restricted." The US Cybersecurity and Infrastructure Security Agency (CISA) also advised in December 2024 not to use SMS as a second factor.

How the terms 2FA, two-step verification, and passkey relate is summarized in the comparison table in what 2FA is.

How TOTP works: the QR code holds the secret

The QR code you scan when setting up an authenticator app contains a secret value shared by the service and the app. The app computes the code from this value and the current time, and the service does the same calculation to check for a match.

The standard (RFC 6238) recommends a 30-second time step
To allow for network delay, services often also accept the code from the previous step (the standard recommends at most one step)
Counter-based HOTP (RFC 4226) moves forward each time, for example, you press a button

It follows that anyone holding the QR code or secret string can generate the same codes. Keeping a screenshot of the setup screen in the cloud or a chat is the same as writing down a password.

A real example: unauthorized online banking transfers

In 2023, unauthorized online banking transfers surged in Japan. According to Japan's Financial Services Agency (FSA), losses from January to November 2023 reached 5,147 cases and about ¥8.01 billion (as of December 8), both record highs. The FSA describes the method as luring users to fake sites with emails or SMS posing as banks, stealing online banking IDs, passwords, one-time passwords, and similar information, and then transferring money out.

Two lessons from this case:

A one-time password doesn't stop it once you type the code into a fake site: however short the code's lifetime, it's in time if it's used the moment you enter it
The place to stop it is before you type: banks say they don't ask for IDs or passwords by email or SMS. Not entering codes on a page you opened from an email or SMS link is the most reliable step a user can take

Since then, brokerages and banks in Japan have been moving to make authentication that won't complete on a fake site, such as passkeys, mandatory (what a passkey is).

How to check your own accounts and services

Move accounts that use SMS to an authenticator app

Open the 2FA settings for important accounts such as email, your password manager, GitHub, and cloud services. If they use SMS, add an authenticator app (TOTP) and make it the preferred method. If passkeys are available, add one too. For GitHub, see setting up GitHub 2FA.

Prepare for a new phone or a lost phone

Check that your authenticator app can move to another device (its backup or transfer feature). Save each service's recovery codes somewhere other than the phone, such as your password manager.

Make sure the QR code and secret aren't lying around

Look for screenshots of setup QR codes or secret strings in your photos, cloud storage, or chats, and delete any you find.

If you build the service, review the verification rules

Limit failed attempts when verifying codes (a 6-digit code can realistically be brute-forced otherwise). Accept the same code only once, even within its validity window. Keep the accepted clock drift to about one step. Offer passkeys, which are stronger than one-time passwords, for admin accounts.

This site's view: OTP is an intermediate step; the goal is passkeys

OTP is an excellent first step out of "password only." In fact, whether SMS or TOTP, just turning it on stops most takeovers. But this site treats OTP as an intermediate step, not the final goal. As long as adversary-in-the-middle phishing is a real threat, the goal is a passkey (FIDO2), whose signature is bound to the domain and structurally can't be presented to a fake site.

The priority is clear: turn OTP on everywhere first, then move your most important accounts (email, domain, payments) to passkeys. The point is not to rely on "spotting the fake site by being careful."

Sources (primary)

IETF RFC 6238, "TOTP: Time-Based One-Time Password Algorithm" — rfc-editor.org (30-second time step, at most one step allowed for network delay)
IETF RFC 4226, "HOTP: An HMAC-Based One-Time Password Algorithm" — rfc-editor.org (counter-based one-time passwords, throttling failed attempts)
NIST SP 800-63B-4 (August 2025) — pages.nist.gov (manually entered OTPs can't be phishing-resistant, phone-network methods are restricted, accept a given OTP only once, rate limiting)
CISA, "Mobile Communications Best Practice Guidance" (December 2024) — cisa.gov (PDF) (do not use SMS as a second factor)
Financial Services Agency of Japan, warning on surging phishing-related unauthorized online banking transfers (Japanese) — fsa.go.jp (January–November 2023 cases and losses, theft of one-time passwords and similar data)

FAQ

QHow is a one-time password different from a regular password?

A regular password stays the same (fixed) until you change it, so once it leaks it can be abused until you rotate it. A one-time password (OTP) is disposable — valid only once and only briefly — and becomes invalid the moment it's used. That makes it hard to reuse even if it's seen, covering the weaknesses of fixed passwords (leaks and reuse). Many services use it as a second proof on top of your password, as one method of two-factor authentication.

QIs an SMS one-time password safe?

It's clearly stronger than a password alone, but it's the weakest kind of OTP. SMS can be intercepted via SIM swapping (hijacking your phone number) or siphoned by adversary-in-the-middle phishing where a fake site relays it. Where you can, move to an authenticator app's TOTP, and for important accounts, to a passkey.

QWhy does the authenticator-app code change every 30 seconds or so?

Because it's a TOTP (time-based one-time password). The app and the service each compute the same code from a shared secret and the current time, on a fixed interval (often 30 seconds). When the interval passes, the old code becomes invalid and a new one takes over. Keeping it short-lived narrows the window in which a stolen code is usable.

QWhat should I do if I typed a one-time password into a fake site?

Assume the code has already been used. Log in through a bookmark or the official app — not a link in an email or SMS — and change your password. Then review the list of signed-in devices and sessions, and check that your registered email, phone number, and payees haven't been changed. For a bank or brokerage, contact the company right away.

QWhy does my authenticator app code keep getting rejected?

A common cause is the phone's clock being off. TOTP computes the code from the current time, so if your device clock drifts, it produces a different code from the service. Set your phone's date and time to automatic, then try the next code shown.

QWhich is safer, a one-time password or a passkey?

A passkey. With a one-time password a person reads and types the code, so entering it on a fake site lets it be relayed as is. NIST also says manually entered one-time passwords can't be phishing-resistant. A passkey's signature is bound to the site's domain, so login won't complete on a fake site.