TechKnowSurge
NIST 800-53 IA-2 NIST 800-53 IA-5 CompTIA Security+ 4.6 ISC2 CISSP 5.6
TechKnowSurge Catalog Videos One-Time Passwords (OTP)
VideoSecurityFree

One-Time Passwords (OTP)

One-time passwords (OTPs) are a widely used multi-factor authentication method that generate short-lived, single-use codes to verify possession of a trusted device. They are delivered either through SMS or an authenticator app and expire after a set time window, typically between 30 seconds and 15 minutes.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

One-time passwords are a widely adopted method for satisfying the possession factor in multi-factor authentication. Where a traditional password represents something a user knows, an OTP helps verify something a user has — typically a mobile device — by generating or delivering a short-lived code that only someone with access to that device could provide. This makes OTPs a practical and effective second layer of security when combined with a standard username and password login. An OTP is a numeric code, commonly six or eight digits, that is valid for a strictly limited period — anywhere from 30 seconds to around 15 minutes — and can only be used once. Once the code is entered or the time window expires, it becomes invalid and a new code must be generated or requested. This time-bound, single-use nature significantly reduces the risk of credential replay attacks compared to static passwords. OTPs reach users through two delivery models. In-band delivery means the code arrives through a channel already in use for other communications, such as an SMS text message. Out-of-band delivery uses a separate channel, most commonly a dedicated authenticator app that generates codes locally on the device. Both approaches are widely used, though authenticator apps are generally considered more secure than SMS-based delivery. Regardless of delivery method, the OTP is tied to a specific device, reinforcing proof of possession. The terminology around OTPs varies across platforms and vendors — the same concept may appear as a one-time PIN, passcode, authorization code, or dynamic password. Despite these naming differences, the underlying mechanism is consistent: a temporary, device-associated code that forms part of a multi-step authentication process, most often presented as the second step in a two-step verification flow.

What you'll learn

What's covered

One-Time Passwords (OTP)

Aligned to

NIST 800-53
IA-2 Identification and Authentication (Organizational Users)
IA-5 Authenticator Management
CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
ISC2 CISSP
5.6 Implement authentication systems

Key terms

Multi-Factor Authentication
MFA
An authentication method that requires users to provide two or more verification factors to gain access.
Two-Factor Authentication
2FA
An authentication method that requires two distinct forms of verification before granting access.
Authentication
The process of verifying the identity of a user, device, or system.
One-time Password
OTP
A One-time Password is a code valid for only a single authentication session or transaction, generated by hardware tokens, authenticator apps, or SMS, providing stronger security than static passwords by eliminating the risk of credential replay attacks.
In-Band Authentication
Delivery of a one-time password through the same communication channel already in use, such as SMS text messaging.
Out-of-Band Authentication
Delivery of a one-time password through a separate communication channel, such as an authenticator app, distinct from the primary login channel.

Topics

One Time Passwords Multi Factor Authentication Totp Sms Authentication Authenticator Apps Identity And Access Management Cryptography

Transcript

A common multifactor authentication method used nowadays is one-time passwords.

Verifying something you have

When somebody is going through the authentication steps, we want to check multiple factors — that's part of multifactor authentication. Maybe it's something you know, like a password, and then maybe something you have. But how do we verify something like a phone? How do we verify that you have that phone? The answer to that, a lot of times, is one-time passwords. Not always, but a lot of times we use a one-time password.

A one-time password is just a password that's given to you one time. It's meant for a short period of time — maybe that's 30 seconds, maybe it's a minute, maybe it's 15 minutes — but it's only going to be available for a certain period of time. Once you use it, then it's no longer valid, it's no longer good, and so you just use it for one time.

How do we use it to verify a phone? This is either going to be sent to that device with something like a text message, or it's going to be generated on that device, like with an authenticator app. Essentially what that code is, is it's specific to this device, and so now you're going to use that code in order to log into a system, or be able to access, as part of the authentication process.

Other names for it

One thing to note is that one-time passwords could be called many different names. Some may call it a one-time PIN, or passcode, or authorization code, or perhaps a dynamic password. These might mean a little different terms, but essentially they all mean that you're going to be given a code as part of your login process, as part of your password process.

A lot of times it goes hand in hand with two-step verification, where it asks for your username and password on one screen, and then the second step it asks for that one-time password. Most of the one-time passwords that I've seen come in either a six or an eight number code that gets entered in during your login process.

In-band and out-of-band

There is something called in-band and out-of-band, and that is how the code comes to you. If it's in-band, it means that it's in one of the bands you're already used to receiving communication on. For instance, SMS — a lot of us are already receiving text messages, and so as part of your login process maybe you receive a text message. That's called in-band. Out-of-band is when you receive it from maybe an authentication app.

Expiry

Here are some examples of different one-time passwords. The idea is you'll be given a code that you'll enter in during the login process, but if you don't enter it in in a quick enough time, then that code will change. Perhaps it expires in 30 seconds, maybe it's a minute, maybe it's 15 minutes, but it'll eventually expire, and then you'll have to request a new code, or a new code will be generated for you, and then you'll enter that in. There are multiple standards out there for these one-time passwords.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →