A time-based one-time password is a short authentication code that changes at fixed intervals, usually 30 seconds, and is used as a second factor during login. TOTP is generated from a shared secret and the current time, making the code valid only briefly and reducing replay risk in MFA workflows.
How TOTP Works
TOTP combines a shared secret with the current time to produce a short-lived code. Because the verifier expects the same time step, the code is only valid for a narrow window and is meant to be used once during authentication.
The design is intentionally simple, but its security depends on the secret remaining private and both parties keeping reasonably synchronised clocks. If the time source drifts too far, users can be locked out or forced into fallback paths that weaken assurance.
Why TOTP Is Used in MFA
TOTP is popular because it adds a second authentication factor without requiring a network call to the authenticator at login time. That makes it broadly deployable across web, VPN, and administrative access flows, including environments where hardware tokens or push approvals are not practical.
Its value is strongest against password replay and basic credential stuffing. A stolen password alone is usually not enough, but TOTP still depends on the login flow protecting the OTP entry point from phishing, relay, and real-time interception.
TOTP Secret Handling and Enrollment
The security of TOTP rests on the seed, not just the six-digit code the user sees. When an enrolment QR code or seed is exposed, an attacker can generate valid codes indefinitely until the secret is replaced. The authenticator app guide explains the related operational issues around authenticator apps and one-time passwords, including seed storage, backup codes, and migration.
Because the same seed can be copied into multiple devices, organisations must treat TOTP setup as a secret provisioning event. That makes inventory, secure issuance, and recovery procedures part of the control, not just the login experience.
Common Failure Modes and Limits
TOTP is useful, but it is not phishing-resistant by itself. Real-time adversary-in-the-middle attacks can capture the code and reuse it within the valid time window, and users may also be tricked into approving a fraudulent session on a fake login page. The broader MFA guidance on MFA methods and bypass paths covers why TOTP remains weaker than phishing-resistant authentication.
Operationally, the main limits are time drift, recovery-code handling, seed exposure, and fallback mechanisms that quietly downgrade assurance. If an organisation allows reset paths that are easier than the primary factor, attackers often target those instead of the code itself.
Risk and Threat Considerations
TOTP reduces replay risk, but it does not stop credential phishing, adversary-in-the-middle relay, or theft of the shared seed. The most serious exposure appears when attackers can steal the password and capture a live code inside the valid time window, or when they obtain the seed and generate codes later without the user present.
Failure mechanism: An attacker either relays a fresh code in real time or clones the shared secret during enrolment, backup, or recovery, then uses valid codes to complete login.
Impact: Account takeover can follow, along with session theft, access to sensitive systems, and the need to re-enrol affected users and rotate any secrets protected by the compromised account.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | TOTP is a user authentication factor for interactive logon. |
| IA-5 — Authenticator Management | TOTP depends on shared-secret issuance, storage, rotation, and revocation. | |
| IA-8 — Identification and Authentication (Non-Organizational Users) | TOTP is also used for external customer and partner authentication flows. | |
| Recommendation — Use IA-2 to require strong multi-factor authentication for organizational logins. Use IA-5 to govern TOTP seed lifecycle and recovery handling. Use IA-8 to enforce MFA for external users who access your services. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The TOTP concept sits within authenticator assurance, phishing resistance, and multi-factor enrollment guidance. |
| Recommendation — Adopt 800-63 guidance to choose authenticators and assurance levels appropriate to the access risk. | ||
| CIS Controls v8 | CIS-5 — Account Management | TOTP enrolment, recovery, and account reset flows are account-lifecycle controls. |
| Recommendation — Harden account lifecycle controls so TOTP reset and recovery cannot become an attack path. | ||
Practitioner Guidance
Why practitioners should care: TOTP is still a meaningful step up from passwords alone, but it should be treated as a transitional control, not a final state. If the threat model includes targeted phishing or high-value access, pair it with stronger phishing-resistant methods rather than assuming the OTP closes the gap.
Common misunderstanding: Many teams treat “MFA enabled” as equivalent to “phishing-resistant.” TOTP improves resistance to some attacks, but a live attacker can still intercept or replay the code during the login transaction.
Practitioner takeaway: Protect the seed as carefully as a password database, review fallback and recovery flows, and prefer stronger authentication for privileged or high-risk access.
Related resources from NHI Mgmt Group
- What is the difference between a time-based one-time password and a digital signature?
- Why does SMS-based one-time password delivery improve password reset security compared with knowledge questions alone?
- What risks does HMAC-Based One-Time Password reduce?
- How does HMAC-Based One-Time Password work?