Skip to main content
Share Your Experience: Take the 2024 Developer Survey

One-time password (OTP) protocols and implementations (software and hardware)

A one-time password is a password that is only valid for one login attempt. Some common OTP models include:

  • A pre-arranged list of passwords, that both the client and the server go through one by one. This list can be stored in a file or printed.
  • Alternatively, the passwords may be sent out-of-band to the client (e.g. with an email or an SMS).
  • Passwords generated by a suitable method from a shared secret. The server sends a challenge to the client, and the client must compute the password from the shared secret and the challenge. The challenge can be a count of login attempts, or something more arbitrary. Often the password is generated by an OTP calculator, also called OTP token, which is a small device that contains the shared secret and performs the necessary calculations. Some OTP devices have their own interface to display the password, while others need to be connected to a computer (e.g. smartcards). OTP can also be implemented in software on general-purpose devices such as mobile phones.
  • Alternatively, the challenge may be the current time. In this case, the OTP is actually valid for a small length of time, typically a few minutes.

OTP are often used as a what you have authentication factor for authentication (what you have is the OTP token device).

There are many different OTP protocols, including S/KEY, HOTP, TOTP, … OTP token devices include , …