TOTP — Time-Based One-Time Password
What is TOTP?
A TOTP (time-based one-time password) is a one-time passcode generated locally by an authenticator app — not sent over a network — using a shared secret and the current time. A user scans a QR code to add a shared secret to their authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or Apple Keychain), then reads a new 6-digit code every 30 seconds. Because the code is generated locally and time-based, not sent via SMS or email, TOTP requires no phone number or email address, making it a privacy-first second factor.
More detail
TOTP is time-based: a new code is generated every 30 seconds using a mathematical algorithm (HMAC-based One-Time Password) that both the server and the app compute independently from the same shared secret. Clock skew tolerance allows a small window of codes (usually ±30 seconds) to account for minor time differences between devices.
HOTP (hash-based one-time password) is similar but counter-based — it generates a new code each time the user taps a button — rather than time-synchronized. TOTP is more common for login 2FA because time-based codes don't require user action between verification attempts.
TOTP offers three security advantages: it requires no SMS/email delivery infrastructure, it cannot be intercepted in transit because it is never transmitted, and it contains no identifying information (no phone number or email address), so it is more privacy-preserving than SMS or email OTP.
Frequently asked
- How does TOTP differ from SMS OTP?
- SMS OTP sends a code over a text message, which requires network connectivity and exposes the phone number receiving the code. TOTP generates a code locally in an authenticator app every 30 seconds using a shared secret, needs no network after setup, and exposes no personal information.
- How is TOTP different from HOTP?
- TOTP (time-based) generates a new code every 30 seconds using the current time. HOTP (hash-based/counter-based) generates a new code each time the user presses a button on their authenticator. TOTP is more common for login because time-based codes work without user action between attempts.
- Do all authenticator apps work the same way?
- Yes. Any TOTP-compliant authenticator (Google Authenticator, Authy, Microsoft Authenticator, Apple Keychain, 1Password, Bitwarden) can read a shared secret and generate a valid TOTP code. The standard is interoperable across vendors and devices.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.