Home / Knowledge hub / TOTP
Knowledge hub
TOTP
The six-digit code from an authenticator app, changing every thirty seconds.
What it means
TOTP means time-based one-time password. It is the six-digit code in an authenticator app that changes every thirty seconds.
Your app and the server share a secret once, usually through a QR code. Each then derives the same code from that secret and the current time. Nothing travels between them, which is why the code still works with the phone in aeroplane mode. RFC 6238 defines the algorithm.
Why it matters
TOTP is the most common second factor, and it defeats the most common attack. Somebody holding a password stolen from another site cannot sign in, because they do not have the code.
It does not stop everything. A convincing fake login page can ask for the code and spend it within its thirty seconds, so hardware keys remain stronger. Even so, moving an account from password only to TOTP removes a large share of real takeovers. Require it rather than offer it. A second factor that only careful people switch on protects only careful people.
How it shows up
The weak points sit around the edges. Recovery codes emailed in plain text. A support process that turns the second factor off on request. An API route that still accepts a password alone while the web login asks for a code.
Decide the recovery path before you launch it. Whatever route lets a locked out customer back in is the route an attacker will try. Treat the setup QR code as a secret as well, because anybody who photographs it can generate your codes from then on. The Cyberlop console uses TOTP for multi-factor today. How we protect accounts.
Questions people ask
TOTP, answered
Is TOTP better than getting a code by SMS?
Yes, clearly. SMS codes travel over a network you do not control. An attacker who talks your carrier into moving your number to a new SIM receives them instead.
TOTP never sends the code anywhere. The device computes it, so SIM swapping and message interception stop working.
Can TOTP be phished?
Yes. A fake login page can collect the password and the code together, then replay both to the real site inside the thirty second window. Ready-made kits do exactly this.
Passkeys and hardware security keys resist that, because they check the domain before they answer. TOTP cannot.
What happens if I lose my phone?
You fall back on the recovery codes the service gave you at setup, so store those somewhere you will still reach without the phone.
Without them you are at the mercy of an account recovery process, which is slow at best. Note that this process is also the part attackers probe.
How does the code work with no internet connection?
Both sides already hold the shared secret, and both can read the clock. The code comes from combining those two things, so nothing needs to travel.
The only requirement is that the phone and the server roughly agree on the time. Servers usually accept a code from the adjacent window to allow for drift.
Should we skip TOTP and go straight to passkeys?
Passkeys are stronger, and if you can ship them, do. In practice most teams support both, because customers arrive with devices and habits you do not control.
Offering TOTP alongside passkeys is far better than leaving accounts on a password alone while you wait for the larger project.
Related
Terms that sit next to this one
MFA
A second proof beyond the password, usually a code or a hardware key.
Authentication
Proving you are who you say you are. It answers one question only.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Account takeover
An attacker ends up signed in as one of your real users.
Does every route ask for the code?
Authentication sits among the ten classes Cyberlop tests, including the API routes that quietly accept a password on its own. Ask us to run it against one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.