OTP (One-Time Password)

An OTP (one-time password) is a code that works for only one use or a very short time window. It is delivered by SMS, email or a voice call, or generated locally by an authenticator app or hardware token.

Why it matters

A static password can be reused by anyone who steals it; an OTP expires, so a captured value is useless soon after. OTPs are a common second factor in logins and a common step-up check for payments, including card 3-D Secure and bank transfers. Two standard algorithms exist: HOTP (RFC 4226) uses a counter, and TOTP (RFC 6238) uses the current time, typically refreshed every 30 seconds. SMS delivery is convenient but weaker than app-based codes because messages can be intercepted or phones swapped.

Example

Your code is 482913. It expires in 5 minutes.
Do not share it with anyone.

The server stores a hash of the code with an expiry time and an attempt counter, compares the user's input, and invalidates it on success or after too many failures.

Common mistakes

• Sharing an OTP with someone who calls claiming to be from a bank. This is a standard social-engineering scam.
• Not limiting attempts or resend frequency, enabling brute force and SMS cost abuse.
• Allowing long expiry windows.

Rules vary by country; this entry is a definition only.

Related

• Two-factor authentication
• 3-D Secure
• Social engineering
• Rate limiting

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.