What is an OTP code?

OTP stands for one-time password: a short code that works once, then never again. You've used them without the acronym — the six digits from an app, the number in a text message, the code in a confirmation email.

The "one-time" part is what makes them useful. A password that never changes can be stolen today and used next year. A one-time code is worthless almost immediately.

The kinds you'll meet

TOTP — time-based. Generated on your device from a shared secret plus the clock, changing every 30 seconds. This is what an authenticator app produces, and it needs no network — how TOTP works.

HOTP — counter-based. The same idea, but it advances a counter instead of using time. Rarer, mostly on hardware tokens.

SMS and email codes. Sent to you rather than generated. Convenient, familiar, and the weakest of the group: a text can be redirected with a SIM-swap attack, and an email code is only as safe as the inbox — which is why you should secure your email first.

Push approvals. A "was this you?" prompt you tap. Fast, but vulnerable to approval fatigue — we compare them in push vs TOTP.

Why an app-generated OTP is the sweet spot

It's free, it works offline, there's nothing in transit to intercept, and it's supported nearly everywhere. That combination is why security guidance generally puts an authenticator app above SMS.

The one thing OTPs don't fix

A one-time code doesn't help if you hand it to a convincing fake site within its 30-second window. That's real-time phishing, and the defence is habit: never enter a code on a page you reached from a link.

Getting started

Check whether your service offers app-based codes in the directory, then follow its setup guide. Adding an account takes about a minute — scan its QR code.