A one-time password is a password that is only valid for one login attempt. Some common OTP models include:
- A pre-arranged list of passwords, that both the client and the server go through one by one. This list can be stored in a file or printed.
- Alternatively, the passwords may be sent out-of-band to the client (e.g. with an email or an SMS).
- Passwords generated by a suitable method from a shared secret. The server sends a challenge to the client, and the client must compute the password from the shared secret and the challenge. The challenge can be a count of login attempts, or something more arbitrary. Often the password is generated by an OTP calculator, also called OTP token, which is a small device that contains the shared secret and performs the necessary calculations. Some OTP devices have their own interface to display the password, while others need to be connected to a computer (e.g. smartcards). OTP can also be implemented in software on general-purpose devices such as mobile phones.
- Alternatively, the challenge may be the current time. In this case, the OTP is actually valid for a small length of time, typically a few minutes.
OTP are often used as a what you have authentication factor for multi-factor authentication (what you have is the OTP token device).