One-Time Password (OTP): The Code That Works Only Once

The password you normally use is like a front-door key. The key never changes, so if someone steals and copies it, or spies on your password, they can walk in anytime. No matter how long or complicated your password is, once it leaks, it's over.

A one-time password is more like a magic lock where the lock and the key change together every time you open the door. Even if a hacker spies the code you just used on your screen, a number that has already been used and thrown away is worthless.

On top of that, it usually expires on its own after a very short window, about 30 seconds to a minute. Even if the code is exposed along the way, it goes dead soon after, so no one can use it later.

If you've ever used an OTP device or an authenticator app, you may have been amazed that the code matches even when your connection is down. The bank's server and your phone don't talk to each other in real time, yet they come up with the same number. The secret is a precise clock and a secret math formula.

When you first set it up, the bank's server and your phone share the same secret key that nobody else knows. Then both sides plug the current time and that secret key into the same math formula (an algorithm) and run the calculation on their own.

Because both use the same formula at the same moment, based on world standard time, the same 6-digit code shows up on both screens every 30 seconds, with no communication at all. This method is called a time-based one-time password (TOTP).

A one-time password is a great way to blunt the damage from password leaks, but it isn't a master key that stops every cyberattack. Even if the OTP itself is solid, it can be weak against scams that exploit human mistakes.

A classic example is a phishing attack, where a fake bank website tricks you into typing in your OTP. The moment you enter the code on the fake site, the hacker can grab it in real time and quickly type it into the real bank site within the 30-second window.

So even when you use an OTP, always check that the website address is the real one. Also, codes sent by text message can be exposed through malware on your phone or interception of the message, so a dedicated authenticator app is considered safer. Still, codes from an authenticator app can also be stolen by phishing. Security keys and passkeys are stronger against phishing, because the device itself checks the address of the site you're visiting.