How One-Time Passwords Are Generated: HOTP, TOTP and SMS Codes Compared
A code that changes every thirty seconds feels like magic. It is not. It is a shared secret, a clock and a small formula. Understanding it helps you choose the right second factor.
Three kinds of codes
| Kind | What changes the code | Where it is made |
|---|---|---|
| HOTP | A counter that goes up each time | On the device and the server |
| TOTP | The current time, in short steps | On the device and the server |
| SMS code | A random value made by the server | On the server, then sent to you |
How TOTP works
- When you enable it, the service shares a secret with your app, usually through a QR code.
- Your app combines the secret with the current time step.
- It produces a short code.
- The server does the same calculation and compares.
Why SMS is different
An SMS code is not computed on your phone. It travels over the phone network, so it can be delayed, intercepted through a SIM swap or sent to a number you no longer own.
What this means for you
- Prefer an authenticator app for important accounts.
- Keep backup codes, because a lost phone loses the secret.
- Use SMS where it is the only choice.
Related reading
See SIM swap attacks and backup codes.
A tiny example in words
Imagine the secret is a word that you and the server both hold. Every thirty seconds you both mix the word with the clock and keep a few digits of the result. If your clocks agree, your digits match. An attacker without the word cannot guess the digits except by luck.
Choosing for your own accounts
- Important accounts: authenticator app plus backup codes.
- Shared business accounts: a team password manager with two-factor.
- Low-value accounts: SMS is acceptable.
- Highest value: a hardware key.
Questions people ask
Is TOTP safer than SMS?
Generally yes, since it does not travel over the phone network.
Why do codes need an accurate clock?
The server and the app must agree on the time step.
Related guides and pages
Create a free OtpGet account and try it with a small balance.