Why do one-time passwords still matter when users already have strong, unique passwords?

Why one-time passwords still matter in a password-first world

One-time passwords remain useful because they add a separate, short-lived proof at login, rather than relying only on a reusable secret. That distinction matters when the user’s password may be strong but the current session, device, or network path is not fully trusted. They are especially valuable as a fallback step in mixed assurance environments.

What OTPs defend against that strong passwords do not

A strong password protects against guessing and many offline attacks, but it does not solve every login exposure. OTPs reduce the value of intercepted credentials because the code expires quickly and cannot be reused after capture. That makes them useful against replay, phishing kits that forward logins in real time, and some forms of session theft.

OTPs are not a replacement for phishing-resistant authentication, and they are weaker when an attacker can capture and use the code before it expires. They still improve the cost to the attacker by narrowing the usable window, which is why they remain a practical control in environments that have not fully moved to stronger authenticators.

When OTPs are the right control, and when they are only a bridge

OTPs fit best where the goal is to add a second step without redesigning the whole login stack. They are commonly used for account recovery, step-up authentication, and higher-risk actions when the service wants more assurance than a password alone provides. They also work as a transitional control while organisations migrate users to stronger authenticators.

Their limitation is structural: if the OTP is delivered through the same compromised channel as the primary credential, the protection can be thin. SMS and email codes may still be better than nothing in some workflows, but they do not provide the same resistance as phishing-resistant factors or device-bound credentials. Current guidance generally treats them as useful, but not ideal.

Risk and Threat Considerations

OTPs reduce replay risk, but they also inherit the weaknesses of the delivery channel and the user workflow. If an attacker can intercept messages, trick a user into entering the code, or race the victim during a live phishing session, the control still fails. The practical risk is not that OTPs are useless, but that teams overestimate what short-lived codes can stop.

Failure mechanism: The code is exposed through insecure transport, compromised email or phone access, or real-time phishing, then used before expiry as if it were legitimate proof.

Impact: The attacker can complete login, bypass a password-only assumption, and potentially move into account takeover, fraud, or privileged access if the OTP is treated as sufficient assurance.

Practitioner Guidance

What to verify: Confirm what threat the OTP is meant to cover. If the main concern is replay after interception, OTPs can help; if the concern is phishing resistance, prefer stronger authenticators and treat OTPs as an interim measure rather than the end state.

Trade-off: OTPs improve short-term resilience without major user friction, but they add operational dependency on delivery reliability and create a false sense of safety if teams present them as equivalent to modern phishing-resistant authentication.

Practitioner takeaway: Use OTPs where you need a time-limited second proof, but judge them by the channel that carries them and the attack path they actually interrupt, not by the strength of the password that precedes them.

Related resources from NHI Mgmt Group

• Why is MFA still necessary if passwords are already strong and unique?
• Should organisations still use one-time passwords for MFA?
• Why do passwords and one-time codes still leave organisations exposed to identity fraud?
• Which controls matter most when comparing magic links with one-time passwords for authentication flows?