Time-based one-time password (TOTP) uses time as a moving factor, and passwords typically expire within 30-240 seconds. Here are some examples of how a user might receive the OTP.Īfter the OTP is used or the timeframe for use has expired, the code is no longer valid and cannot be reused.

OTPs can also be sent as push notifications to an enterprise’s custom mobile apps or a third-party authenticator app can be used, like Google Authenticator.Īn algorithm is used to create a new, random code each time a passcode is requested. The OTP can be letters and/or numbers and sent via SMS, email or as a voice message as part of the MFA process. The acronym OTP stands for both one-time password and one-time passcode, an automatically generated sequence of characters valid for a single login session or transaction. What is a One-time Password (OTP) and How Does it Work?

According to Microsoft, MFA can “prevent 99.9 percent of attacks on your accounts.” Supplementing a username and password with another authentication factor, known as multi-factor authentication (MFA), can be done with a one-time password (OTP). Organizations that don’t have the time or the resources to fully eliminate usernames and passwords know compromised credentials can be used to execute fraudulent attacks and data breaches.

Onetime password