TOTP (Time-based One-Time Password): How It Works and Its Risks

TOTP (Time-based One-Time Password) is an extra verification step that asks for a code from an authenticator app after the user enters a password. With this layer in place, a leaked employee password is not enough to open that employee’s work account.

According to Cybersecurity Dive’s coverage of the FBI’s 2024 internet crime report, SIM swapping caused about $26 million in losses in the United States. In a SIM swap, the attacker moves the victim’s phone number to a SIM card the attacker controls, so SMS one-time codes go to the attacker instead.

TOTP does not depend on a phone number because the code is generated inside the authenticator app. This article covers what TOTP is, its seven stages, common use cases, how it compares with HOTP and SMS OTP, its risks, and the settings your company needs.

What Is TOTP (Time-based One-Time Password)?

TOTP is a one-time code calculated from two inputs: a secret key tied to the user’s account and the current time. The code is usually 6 digits long and changes every 30 seconds in authenticator apps such as Google Authenticator or Microsoft Authenticator.

The calculation is defined in RFC 6238, a specification published by the IETF (Internet Engineering Task Force) in May 2011. It describes TOTP as an extension of HOTP (HMAC-based One-Time Password) that uses time instead of a counter of generated codes.

Every TOTP code comes from these components:

• A secret key (shared secret), a random string of data stored on the server and in the user’s authenticator app.
• A time step, the sequence number of the current 30-second period, calculated from the device clock.
• HMAC (Hash-based Message Authentication Code), a cryptographic function that turns the key and the time step into a digital fingerprint before it is cut down to a short code.

The server and the app hold the same key and read the clock at the same moment, so both produce an identical code without ever exchanging it.

How TOTP (Time-based One-Time Password) Works

TOTP works in seven stages: three enrollment stages that happen once and four stages that run every time the user signs in. Stages 4 to 6 run separately on the app and on the server, and stage 7 compares the two results.

1. The server creates a unique secret key for the user’s account when TOTP is turned on. RFC 6238 requires a unique key per user and secure key storage, and it recommends a random key as long as the HMAC output (20 bytes for HMAC-SHA-1).
2. The server displays the key as a QR code, usually together with the service name and account name. The user scans it with an authenticator app or types the key in manually if the camera cannot be used.
3. The user enters the first code shown in the app to activate TOTP. A matching code tells the server that the key was saved correctly and that the phone clock has not drifted too far. After this stage, the key never travels between the server and the phone again.
4. At sign-in, the app and the server convert Unix time (the number of seconds since January 1, 1970) into a time step by dividing it by 30 and rounding down. For example, Unix time 1,700,000,000 (November 14, 2023, at 22:13:20 UTC) gives time step 56,666,666, as does every second from 22:13:00 to 22:13:29 UTC.
5. The app and the server turn the time step into an 8-byte value, then process it with the secret key using HMAC-SHA-1 to produce a 20-byte digital fingerprint. RFC 6238 also allows HMAC-SHA-256 or HMAC-SHA-512, as long as the server and the app use the same function.
6. The algorithm takes 4 bytes from that fingerprint at a position set by its last 4 bits, a technique called dynamic truncation. The number formed by those 4 bytes is divided by 1,000,000, and the remainder becomes the 6-digit code shown in the app.
7. The user types the code, and the server calculates the code for the same time step and compares the two. RFC 6238 recommends allowing at most one time step of drift for network delay and forbids the server from accepting the same code twice.

Stages 4 to 6 use only the key and the clock. That is why an authenticator app can generate codes without a cellular signal or an internet connection.

TOTP Use Cases

TOTP is used by services that ask for a second factor after the password, especially services that can be reached directly from the internet. The four examples below are the most relevant for employee access in a company.

1. Work Email and Collaboration Apps

Work email services such as Google Workspace and Microsoft 365 offer verification through an authenticator app. Employees simply type the 6-digit code from their phone after entering their password.

2. VPN and Remote Desktop Access

Employees who work from home usually reach the office network through a VPN or a remote desktop. TOTP at this gateway stops an attacker holding a stolen VPN password from getting into the internal network.

3. Cloud Business Applications

For example, a finance staff member signs in to a cloud accounting app with a password, then opens the authenticator app and types the code it shows. If that password leaked from another website, the attacker is still blocked without the code from the staff member’s phone.

4. Cloud and Server Admin Consoles

Cloud providers such as AWS, Google Cloud, and Microsoft Azure support authenticator apps as a second factor for console accounts. For accounts with admin rights, treat TOTP as the minimum and choose a phishing-resistant method wherever one is available.

TOTP vs HOTP vs SMS OTP

TOTP is a type of OTP whose code depends on time, while HOTP uses a counter and SMS OTP is sent by the server to a phone number. These differences decide how long a code stays valid and which channel an attacker can steal it from.

Aspect	TOTP	HOTP	SMS OTP
Basis for the code	Secret key and the current time	Secret key and a counter that increases each time a code is generated	Generated by the server, then sent over the cellular network
Code validity	One time step, usually 30 seconds	Until the code is used or a new code is generated	Whatever time limit the server sets
Where the code is generated	Authenticator app on the user’s device	Hardware token or app on the user’s device	Service provider’s server
Needs a signal at sign-in	No	No	Yes, to receive the SMS
Main risk	Real-time phishing and leaked secret keys	An unused code stays valid longer	SIM swapping and cellular network interception

For employee accounts, TOTP is safer than SMS OTP because the code never crosses the cellular network and is not tied to a phone number. HOTP is still used in hardware tokens, but its codes do not expire, which gives attackers more time.

If your company still uses SMS OTP for employee access, move the systems that hold customer or financial data to TOTP first.

Read also: TOTP vs Push Notification vs Biometric: MFA Comparison

Benefits of TOTP for Employee Access

TOTP adds a layer of protection without extra hardware costs, because employees only need an authenticator app on their phone. The benefit is clearest for companies that want to require MFA (multi-factor authentication, verification with two or more factors) for every employee on a limited budget.

• A password stolen in a data breach at another website is not enough to sign in, because the attacker also needs the code from the employee’s phone.
• Each code is valid for about 30 seconds and cannot be used twice, so a code someone else sees quickly becomes worthless.
• Your company does not pay for SMS delivery and does not depend on a mobile carrier.
• Because the standard is open, one authenticator app can hold codes for work email, the VPN, and cloud apps that support TOTP.

TOTP Risks to Watch For

TOTP stops attackers from using stolen passwords, but it does not stop attackers who trick employees directly or steal the secret keys. Weigh the four risks below before making TOTP your only second factor.

1. Real-Time Phishing

An attacker can build a fake login page that relays the victim’s password and TOTP code to the real site within seconds. NIST SP 800-63B-4, the authentication guideline from the US standards body, classifies OTPs as not phishing-resistant.

For admin accounts and access to sensitive data, use a phishing-resistant method such as a passkey or a FIDO2 security key. Both respond only to the genuine domain, so they cannot be used on a fake site.

2. Leaked Secret Keys on the Server

The server stores every user’s secret key, so an attacker who breaches the key database can calculate anyone’s TOTP codes. Store these keys encrypted and separate from other login data.

3. Lost or Replaced Phones

An employee who loses a phone or switches devices without moving the authenticator app is locked out of the account. Without a clear recovery process, the helpdesk may be tempted to reset access based on nothing more than a phone call.

4. Out-of-Sync Device Clocks

If the phone or server clock drifts beyond the allowed tolerance, even a correct code is rejected. This usually happens on phones with manually set time or on servers that are not synced to a standard time source.

TOTP Settings Your Company Should Prepare

Before you require TOTP for employees, decide how keys will be stored, how accounts will be recovered, and how sign-in attempts will be limited. The settings below address the risks above without making sign-in harder.

1. Store secret keys in encrypted form, and limit access to the key database to the authentication system only.
2. Show the enrollment QR code only after the employee signs in with a password, and never send QR codes by email or chat.
3. Issue single-use recovery codes during enrollment, and ask employees to keep them somewhere safe.
4. Limit the number of wrong code attempts, then lock the account temporarily once that limit is reached. A 6-digit code has only one million combinations, and without an attempt limit it can be guessed.
5. Sync server clocks to a standard time source using NTP (Network Time Protocol).
6. Set a device replacement process that verifies the employee’s identity, such as confirmation from a direct manager or an in-person check, before a new key is created.
7. Require phishing-resistant methods for admin accounts, and make TOTP the minimum standard for everyone else.

An IAM (identity and access management) platform with centralized MFA can apply these settings once for every application. Your IT team then does not need to configure TOTP separately in each app.

Read also: MFA Implementation: A Structured Strategy for Enterprise Access Security

Conclusion

TOTP is a code calculated from a secret key and the time, which makes it safer than SMS OTP and usable without a signal. Its codes can still be stolen through real-time phishing, so admin accounts should use passkeys or security keys.

Start by listing the work systems that still rely on SMS OTP. Move those systems to TOTP, along with recovery codes and a limit on sign-in attempts.

FAQ