TOTP
Also known as: Time-based One-Time Password · Time-Based OTP
Definition
TOTP (Time-based One-Time Password, RFC 6238) is a 6-8 digit code derived from a shared secret + current time, regenerated every 30 seconds. The most common implementation underlying authenticator apps like Google Authenticator, Authy, and Microsoft Authenticator.
TOTP is built on HMAC-SHA1 (or SHA-256) over a shared secret seed and a Unix-time counter. The current time is divided by a step (typically 30s) and HMAC'd with the seed; the result is truncated to a numeric code. Both client and server compute the code independently from the shared seed.
TOTP is broadly supported and far stronger than SMS, but is still phishable in real time. It's also vulnerable to seed compromise if backup codes leak. Phishing-resistant alternatives (FIDO2) are preferred where available.