# one-time-password

Source: https://startwithidentity.com/glossary/one-time-password/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

A one-time password (OTP) is a code that is valid for a single sign-in or transaction, either generated by an authenticator from a shared secret, as in HOTP ([RFC 4226](https://www.rfc-editor.org/info/rfc4226/), counter-based) and TOTP ([RFC 6238](https://www.rfc-editor.org/info/rfc6238/), time-based with a 30-second default step), or sent by the service over SMS, voice or email.

[NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) states plainly that "OTP authentication is not phishing-resistant", because a code a person reads can be typed into a fake page and relayed before it expires. SMS and voice delivery add their own weaknesses, [SIM swap](https://startwithidentity.com/glossary/sim-swap/) and number porting among them, and NIST treats the phone network as a "restricted" authenticator that verifiers should only use after checking signals such as a recent SIM change. Both problems are live: the InsureOTP kit in July 2026 [asked insurance customers for their OTP "as routine identity verification" and relayed it to the real portal](https://startwithidentity.com/blog/2026-07-25-insurance-phishing-evolves-into-real-time-otp-relay-account-hijacking/), and Microsoft Entra ID [stops delivering its own SMS and voice codes on February 1, 2027](https://startwithidentity.com/blog/2026-09-21-entra-id-stops-delivering-sms-and-voice-codes-february-1-and-global-admins-go-last/).

See also: [HOTP](https://startwithidentity.com/glossary/hotp/), [TOTP](https://startwithidentity.com/glossary/totp/), [OTP relay social engineering](https://startwithidentity.com/techniques/otp-relay-social-engineering/), [two-factor authentication](https://startwithidentity.com/glossary/two-factor-authentication/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/)