Time-Based One-Time Password

Time-Based One-Time Password (TOTP) is a security mechanism that generates temporary, time-sensitive passwords for authentication, typically used in two-factor authentication (2FA) systems. It works by combining a shared secret key with the current time to produce a numeric code that changes every 30-60 seconds, enhancing security by preventing password reuse and mitigating replay attacks.

Also known as: TOTP, Time-based OTP, 2FA token, Authenticator code, One-time password

Why learn Time-Based One-Time Password?

Developers should learn and implement TOTP when building applications that require strong user authentication, such as banking apps, enterprise systems, or any service handling sensitive data. It is particularly useful for adding a second layer of security beyond passwords, reducing the risk of unauthorized access due to credential theft or phishing, and is widely supported by standards like RFC 6238 and tools like Google Authenticator.

Learning Resources

• docs: RFC 6238: TOTP Specification
• docs: Google Authenticator Implementation Guide
• tutorial: TOTP Tutorial on Auth0 Blog
• course: Two-Factor Authentication Course on Coursera