IT Glossary
TOTP is the six-digit code produced by authenticator apps. Learn how the algorithm works, what it protects against, and where phishing defeats it.
August 7, 2026
A Time-Based One-Time Password (TOTP) is a short numeric code, usually six digits, generated from a shared secret and the current time, and valid only for a brief window of about 30 seconds. Defined in RFC 6238, it is the mechanism behind authenticator apps such as Google Authenticator, Microsoft Authenticator, and 1Password.
TOTP stops password reuse and credential stuffing, because a stolen password alone is no longer enough. It does not stop real-time phishing: a convincing fake login page can ask for the code and replay it within its validity window. That limitation is why European organizations under NIS2, which lists multi-factor or continuous authentication among its baseline measures in Article 21(2)(j), increasingly move privileged accounts to phishing-resistant factors such as FIDO2.
A 120-person company enables TOTP on every SaaS admin console. Six months later an administrator receives a login page identical to the real one, enters her password and her code, and the attacker relays both in real time. TOTP was correctly configured and still failed. The right response is not to remove it but to move admin and finance accounts to FIDO2 while keeping TOTP as the baseline elsewhere, which first requires knowing exactly which applications hold admin rights. Corma builds that inventory from the live SaaS estate.
TOTP is one way of delivering a second factor. Two-factor authentication is the broader principle of requiring two different types of proof before granting access.
Yes. A TOTP code is generated on the device and never travels over a mobile network, so it is not exposed to SIM swapping or interception at the carrier level.
Access is restored through backup codes issued at enrollment or through an administrator reset. Both paths need a controlled process, since help desk resets are a favorite social engineering target.
Yes. A real-time proxy phishing page can capture a code and replay it inside its 30-second window. Only origin-bound factors such as FIDO2 remove that risk entirely.
