One-time password authentication is a sign-in method that asks for a password valid for a single login or transaction. The code is usually generated by an authenticator app, token, SMS message, or hardware device, and it reduces reuse of a captured secret. It is weaker when used alone than phishing-resistant MFA.
How OTP authentication works
One-time password authentication adds a short-lived code to the sign-in flow, so possession of the current code is required in addition to the base credential. That code may come from an authenticator app, SMS, or a hardware token, but the security value comes from short validity and single-use behaviour.
In practice, OTP is often used to reduce the impact of password reuse or a captured static password. It is not a full substitute for stronger phishing-resistant authentication, because a live attacker can still relay or intercept a valid code in real time.
Where OTP fits in authentication design
OTP sits between basic password login and stronger methods such as passkeys or hardware-backed phishing-resistant MFA. It is best understood as a step-up or second factor rather than a complete identity assurance strategy.
Different OTP channels have different trust properties. App-based codes usually avoid telecom dependence, while SMS OTP introduces exposure to SIM swap, message interception, and number porting risk. Hardware tokens can improve reliability, but they still depend on how the secret seed or token is enrolled, stored, and recovered.
Common OTP weaknesses
The main weakness of OTP is that it proves only temporary possession of a code, not that the code was presented to the right relying party. That makes relay attacks, adversary-in-the-middle phishing, and session theft especially important to consider.
OTP also fails gracefully only when the surrounding account recovery and device enrollment process is well controlled. If attackers can reset factors, enroll a new device, or exploit weak recovery paths, the OTP layer may be bypassed even when the code itself is never broken.
Operational consequences for organisations
Organisations should treat OTP as one control in a broader authentication stack, not as the final answer for high-risk access. The strongest deployments combine OTP with risk-based prompts, strict recovery controls, and a path toward phishing-resistant MFA where possible.
For user experience, OTP can be useful because it is widely understood and easy to deploy, but its operational simplicity can hide weak recovery or overbroad exceptions. A secure rollout depends on matching the method to the threat model, the account value, and the available recovery process.
Risk and Threat Considerations
OTP is attractive to attackers because it can be defeated without cracking the underlying password. If an attacker can phish the code, proxy the login in real time, or intercept SMS delivery, they may gain access even though the organisation believes MFA is in place.
Failure mechanism: Live phishing, code relay, SIM swap, token theft, and weak recovery all let an attacker present a valid OTP within the code's short lifetime.
Impact: Account takeover can follow, along with session theft, privilege abuse, access to internal tools, and downstream exposure of data or secrets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines authenticator assurance and phishing-resistant authentication for OTP-based sign-in. |
| Recommendation — Use phishing-resistant authenticators for higher-risk access instead of relying on OTP alone. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers issuance, protection, rotation and lifecycle of OTP seeds and authenticators. |
| Recommendation — Manage OTP secrets and authenticators through controlled issuance, rotation and revocation. | ||
| OWASP ASVS | V6 — Authentication | Sets verification requirements for authentication strength, MFA and recovery flows. |
| Recommendation — Verify OTP implementations against authentication and recovery requirements, not just login success. | ||
| CIS Controls v8 | CIS-5 — Account Management | Addresses account lifecycle controls that shape OTP enrollment, recovery and access removal. |
| Recommendation — Control account lifecycle to prevent weak OTP enrollment, recovery abuse and orphaned access. | ||
Practitioner Guidance
Why practitioners should care: OTP is still useful, but it should be deployed with a clear understanding of what it does and does not defend against. Treat SMS OTP as the weakest common variant, and be especially careful with accounts that protect administrative access, recovery paths, or sensitive data.
Common misunderstanding: Many teams assume any second factor is equally strong. In reality, OTP strength varies by channel, enrollment process, and recovery design, so the control must be evaluated in context rather than accepted as a generic MFA checkbox.
Practitioner takeaway: Use OTP as a transitional or risk-reduction control, then prefer phishing-resistant methods for higher-value accounts and any workflow where real-time relay would be materially damaging. For deeper background on implementation choices and bypass patterns, see the MFA Guide and the Authenticator Apps and OTP Guide.
Real-world attacks show why this matters. Twilio 0ktapus breach 2022 illustrates how SMS phishing can capture one-time codes, while CitrixBleed exploitation 2023 shows how session token theft can bypass OTP-backed sign-in entirely.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org