# totp

Source: https://startwithidentity.com/glossary/totp/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Time-based One-Time Password (RFC 6238). A six to eight digit code derived from a shared secret and the current time, used by authenticator apps. Phishable, so weaker than passkeys.

TOTP was a real improvement over SMS and is now the most common weak link in an otherwise modern stack, because a code a human reads and types can be relayed by a proxy in seconds. It also carries an enrollment problem: the shared secret is displayed as a QR code that can be screenshotted, backed up, and copied. Keep it as a fallback, not as the target state.

See also: [MFA](https://startwithidentity.com/glossary/mfa/), [HOTP](https://startwithidentity.com/glossary/hotp/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [passkey](https://startwithidentity.com/glossary/passkey/), [one-time password (OTP)](https://startwithidentity.com/glossary/one-time-password/)