A time-based one-time password (TOTP) is a short code generated from a shared secret and the current time. An authenticator app or hardware token calculates it, and a sign-in service checks whether it matches. The common 30-second time step is the default in the standard—not a guarantee that every service accepts a code for exactly 30 seconds.
What TOTP means
TOTP stands for time-based one-time password. It is the time-driven form of HOTP, a one-time-password method whose changing input is an event counter. TOTP replaces that counter with one derived from time, so the authenticator and verifier can independently calculate the same code without sending the shared secret during each sign-in. The method is specified in IETF RFC 6238.
As an Amazon Associate I earn from qualifying purchases.
The authenticator may be a smartphone application or a dedicated hardware device. In either case, it must have the secret and compatible settings needed to generate the code. The sign-in service must have the corresponding secret, or a way to derive it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How TOTP generates a code
TOTP uses the current Unix time to calculate a time-step counter, then applies the HOTP calculation to that counter and the shared secret. The standard expresses the counter as:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
T = floor((current Unix time − T0) / X)
- T is the time-step counter.
- T0 is the starting time. The RFC default is 0, the Unix epoch.
- X is the step size in seconds. The RFC default is 30 seconds.
With those defaults, the counter advances at each 30-second boundary. The RFC’s example gives a counter of 1 at 59 seconds after the epoch and 2 at 60 seconds. The authenticator and verifier need matching step settings and the same secret material to produce matching outputs.
RFC 6238 permits HMAC-SHA-256 and HMAC-SHA-512 as alternatives to the HOTP SHA-1 construction. That does not mean every service supports every algorithm or configuration; the service’s provisioning process determines what will interoperate.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
How long a TOTP code is valid
A code changes when the time-step counter advances, but rollover and acceptance are different things. A verifier may accept a code from a bounded window around the current step to allow for clock drift, network delay, and the time it takes someone to enter the code. The configured window is a verifier policy, not something that can be inferred from the 30-second default alone.
RFC 6238 advises validators to account for prior time steps within their delay policy and warns that widening the window increases exposure; for network delay, it recommends no more than one time step. NIST’s current guidance, SP 800-63B-4, requires a defined lifetime based on expected clock drift over the authenticator’s lifetime, network delay, and claimant entry time. It also requires the verifier to accept a given OTP only once while it is valid, and calls for rate limiting; rate limiting is required when the authenticator output is less than 64 bits.
Rank #3
- Ultra-Compact FIDO2 Security Key – Plug-and-stay or carry on a keychain. This USB-C hardware security key offers portable, always-on protection for desktop and mobile use.(Item Size: 0.73 X 0.60 X 0.30 inches)
- USB-C Hardware Key for All Devices – Works with USB-C ports on PC, Mac, Android, and USB-C iPhones. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key – Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey – Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication – Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
What TOTP does—and does not—protect against
TOTP is an OTP method based on possession of an enrolled secret. Because the secret is held by the authenticator and is also needed by the verifier to reproduce the output, RFC 6238 recommends secure storage and limiting access to that secret. NIST likewise requires strong protection of verifier-side symmetric keys.
A short lifetime does not make a code phishing-resistant. NIST states, “OTP authentication is not phishing-resistant.” A user can enter a live code into an impostor site, which can relay it to the legitimate service before it expires. A manually entered OTP is not bound to the intended website or sign-in session. NIST identifies cryptographic authentication with channel binding or verifier-name binding as phishing-resistant approaches; WebAuthn is an example of verifier-name binding.
Rank #4
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
TOTP’s one-time acceptance rule and rate limiting help address replay and guessing, but they do not make the method immune to credential theft or relay attacks.
Choosing an authenticator format
NIST lists both smartphone authenticator applications and hardware TOTP devices as examples. The choice is practical: verify that the service supports the device’s provisioning format, consider how you will access and protect its secret, and plan how you will recover access if the device is lost or unavailable. A dedicated token is still a manually entered OTP method, so it does not prevent phishing.
Best Value
- FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
- Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
- Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
- Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
- FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.
Standards and current guidance
RFC 6238, published in May 2011, defines the TOTP algorithm. NIST SP 800-63B-4 is the current NIST digital identity guidance; NIST’s publication page lists July 31, 2025, as its final publication date and says it supersedes SP 800-63B. The algorithm’s 30-second default is a parameter in the RFC, not a claim that all services use identical timing or acceptance policies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
