Security Lingo Explained: TOTP (Time-based One-Time Password)
The security space can be a strange and confusing place for newcomers. In this series of posts, we aim to shed light on the security lingo you may encounter when reading the latest security specifications and scanning your favorite Duende documentation. By the end of this post, you'll have added one more security phrase to your growing lexicon of security jargon with which to impress your fellow security professionals.
Today's security lingo is TOTP, so let's discuss what the acronym stands for and where you can see and hear it used.
What is TOTP?
If you grew up in Europe and especially the UK, TOTP might bring back images of Top of the Pops, the legendary BBC music show where artists performed their chart hits in front of a studio audience every Thursday night. For decades, making it onto TOTP meant you'd truly arrived. Sadly, security TOTP involves fewer glitter cannons and more six-digit codes on your phone.
TOTP stands for Time-based One-Time Password. It's an algorithm defined in RFC 6238 that generates a short-lived numeric code from a shared secret and the current time. Because both sides (your authenticator app and the server) know the secret and agree on the time, they independently arrive at the same code without needing to talk to each other.
During setup, the server generates a secret key and shares it with you, usually via a QR code you scan with an Authenticator app like Google Authenticator or Microsoft Authenticator. From that point on, the app takes that secret, combines it with the current 30-second time window, runs it through HMAC-SHA1 (or its stronger siblings SHA-256 and SHA-512, hash algorithms that turn input into a fixed-length fingerprint), and produces a six-digit code. The server does the same math. If the codes match, you're in.
TOTP is a staple of multi-factor authentication (MFA): the "something you have" factor alongside the password you (hopefully) remember. It works offline, doesn't require SMS (which has its own well-documented problems), and is supported on pretty much every platform.
If you're building authentication flows with Duende IdentityServer, Duende User Management provides production-ready TOTP support out of the box. It handles the cryptographic operations, credential storage, and verification logic. Your users scan a QR code once, and from then on they've got a second factor that doesn't depend on cell reception, carrier security, or the postal service.
The main downside? That shared secret needs to stay secret. If an attacker gets hold of it, they can generate valid codes just like you can. So store those secrets carefully, and remind your users that screenshotting their QR code and saving it to a shared Google Drive folder is... not the BCP.
Unlike the BBC show, TOTP codes expire every 30 seconds, and there are no reruns. But that's exactly the point. Now get out there and make sure TOTP is topping the charts in your authentication flows.
We hope you found this post enlightening. If there's other security lingo you're unsure about, please let us know in the comments, and we'll be happy to explain. And while you're here, please take a moment to explore our range of security products and join our community in our public discussions.
