TOTP

TOTP (Time-based One-Time Password) is a security algorithm that generates temporary, single-use passwords based on a shared secret key and the current time. It is commonly used for two-factor authentication (2FA) to add an extra layer of security beyond just a username and password. The passwords typically expire after 30 seconds, making them resistant to replay attacks.

Also known as: Time-based One-Time Password, TOTP algorithm, Google Authenticator standard, RFC 6238, 2FA token

Why learn TOTP?

Developers should learn TOTP to implement secure authentication systems in applications, especially for user login flows in web and mobile apps where enhanced security is required. It is widely used in scenarios like banking, email services, and enterprise software to protect against credential theft and phishing attacks, as it requires both something you know (password) and something you have (a device generating the TOTP).

Learning Resources

• docs: RFC 6238: TOTP Specification
• docs: Google Authenticator Implementation Guide
• video: TOTP: Time-Based One-Time Password Algorithm Explained
• tutorial: Implementing TOTP in Node.js
• docs: Two-Factor Authentication with TOTP on Auth0