An OTP code is a one-time PIN, automatically generated and sent, usually to a mobile device, tablet or desktop, to allow a single login session or transaction. OTP is one of the key elements of two-factor authentication, providing the highest level of security for customer transactions.

Fast and easy to use, OTPs are popular with businesses because they are a highly secure and very cost-effective way to avoid costly fraud incidents.

How are OTPs generated?

OTP generation relies on the server and the user's device having access to the same secure “knowledge”. There are two types of code:

• HOTP (hash-based one-time password): These codes are based on a counter, which is incremented each time a code is generated. This way, the same code can never be used twice and expires as soon as the next code is generated.
• TOTP (time-based one-time password): As the name suggests, this is an extension of HOTP that is only valid for a set time, usually less than 3 minutes, which makes it even more secure.

OTP authentication by email:

The Email OTP method lets you authenticate with the one-time password (OTP) sent to your registered email address. When you try to authenticate to a service, the server sends an OTP to the user's registered email address.

How are OTPs delivered?

The most common way to deliver an OTP is by SMS to a mobile phone.

Why are OTPs better than regular passwords?

OTPs can only be used once and can be set to expire after a short time. Even though regular passwords can be very complex, they are usually only changed every few months, if ever. This makes them much more vulnerable to data breaches. In the most secure solutions, OTPs and passwords are used together to provide the best protection against fraud.