TOTP: definition and how it works
Published and updated
TOTP (time-based one time password) is a code an authenticator app computes from a shared secret and the current time, so it works offline and needs no message to be sent.
How it works
A TOTP setup starts with a secret the server generates once and shows to the user as a QR code. The authenticator app stores it. From then on both sides compute the same six-digit code by hashing the secret with the current thirty-second time window, using the algorithm standardised in RFC 6238. The server accepts the code for the current window and usually one on either side to absorb clock drift.
Because nothing is transmitted, TOTP avoids the failure modes of SMS codes. There is no delivery delay, no per-message cost, no dependence on the phone number, and no exposure to SIM swap or SMS interception. It works in airplane mode and abroad.
Its weaknesses are on the user side. The user must install an app and scan a code, which loses people at signup. If the phone is lost and the secret was not backed up, the account is locked out, so every TOTP deployment needs recovery codes or a second factor. And TOTP is still phishable: a fake login page can relay a code within its thirty-second window, which is why hardware keys with origin binding are stronger.
The usual product answer is to offer both. SMS OTP is the default because everyone can receive it; TOTP is the upgrade for users who want it and the requirement for administrators.
How this applies with textbee
textbee has no role in TOTP itself, since no message is sent. Where it fits is beside it: SMS as the enrolment and recovery channel, or as the default factor for users who never set up an authenticator app.
Related terms
- OTP: An OTP (one time password) is a short code valid for a single login or action and a short time, most often delivered by SMS to prove the user holds the phone number on the account.
- Delivery receipt: A delivery receipt is the network's report that an SMS reached the recipient's handset, or failed to, surfaced by a gateway as a status on the message.