A commonly used algorithm for generating time-sensitive, single-use passwords for multi-factor authentication (MFA) or two-factor authentication (2FA). It is based on the HMAC-based One-Time Password (HOTP) algorithm, which uses a shared secret key and a counter to generate passwords. In TOTP, the counter is replaced by the current time, typically in 30-second intervals. This ensures that the generated password is only valid for a short period. The server and the user's device (usually a smartphone app or hardware token) share a secret key, which is used along with the current time to generate the same password independently.
Algorithm Components
- Shared secret: The server and the user's device share a secret key to generate the same password independently.
- Time-based: The current time replaces the counter in the HMAC-based One-Time Password (HOTP) algorithm, ensuring the password is valid for a short period, typically 30 seconds.
- Password generation: The user's device generates a new 6-8 digit password every 30 seconds, which the user enters with their regular login credentials to access the service.
Synchronization
- Clock synchronization: The server and the user's device must have synchronized clocks for the system to work correctly, as the generated passwords are time-sensitive.
Popular Implementations
- Google Authenticator: A widely used app for generating TOTP passwords.
- Authy: Another popular app for managing TOTP passwords.
- Microsoft Authenticator: A secure app for generating TOTP passwords.
