Skip to content
Know.itKnow.it
Create an animated lesson
On request

This article is free to read. Creating a lesson uses your daily or stored credits; review the language and settings before starting.

How does an OTP work?

TechnologyLesson on requestFree to readयह पेज हिंदी में पढ़ें

Quick answer

An OTP is a one-time password: a short code that works for a single login or transaction. An authenticator app and the server share a secret key, then each combines it with the current time or a counter to produce the same code. You type it in, the server checks it, and the code expires immediately after use.

An OTP works by generating a short numeric or alphanumeric code that is valid for only one login or transaction, so a stolen password alone cannot be reused. Authenticator apps and tokens derive the same code as the server from a shared secret plus the time or a counter; SMS codes are simply generated by the server and texted.

Step by step

  1. During setup, the service and your device share a secret key, often stored in an authenticator app or hardware token; SMS codes are instead generated by the server and texted.
  2. When you request a login, the device uses that secret plus the current time or a counter to compute a code.
  3. The server runs the same calculation independently and expects the same result.
  4. You receive the code by SMS, app, or hardware token and enter it on the login screen.
  5. The server compares your entry with its own calculation, allowing a small time drift, and grants access if they match.
  6. The code is then discarded, so it cannot be used again even if someone copied it.

Key things to understand

  1. A shared secret key is stored on the server and in the user's authenticator app or hardware token during setup.
  2. The device combines that secret with the current time or a counter using a one-way algorithm.
  3. The server performs the same calculation independently to produce the expected code.
  4. The user types the code, and the server checks whether it matches within a short window.
  5. Because the code changes each time, an intercepted OTP becomes useless after it expires or is used.

Labelled diagram

  1. Shared secret

    A unique key is stored on both the server and the user's device during setup.

  2. Time or counter

    The device and server agree on the current time or an incrementing number.

  3. Algorithm

    A one-way function combines secret and time to produce a short code.

  4. User enters code

    The code is sent by SMS or shown in an app, then typed into the login form.

  5. Server verifies

    The server computes its own code and checks for a match within a small window.

How an OTP is generated and checked

Real-world examples

  • A bank sends a six-digit code by SMS when you add a new payee to your online account.
  • Google Authenticator generates a fresh six-digit code every 30 seconds for logging into email.
  • A UPI payment app asks for an OTP to confirm a transfer above a set limit.
  • A hardware token like a YubiKey produces a code when you press its button to log into a corporate network.

Common mistake

✗ Myth: An OTP is just a second password that stays the same every time.

✓ Fact: An OTP changes with every login or transaction and expires quickly, so it cannot be reused. A static second password would offer far less protection because it could be stolen once and used repeatedly.

People also ask

What does OTP stand for?
OTP stands for one-time password. It is a code valid for only one login session or transaction, generated automatically and tied to a shared secret between the server and the user's device. Unlike a regular password, it cannot be memorised or reused, which makes it resistant to replay attacks.
How long does an OTP last?
App-generated codes usually change every 30 seconds, while SMS codes often stay valid for a few minutes. The exact window depends on the service, but the principle is to keep it short enough that an intercepted code becomes useless before an attacker can exploit it. After the window closes, the server rejects the code.
Why do banks send OTP on mobile?
Banks send OTPs to a mobile number because it acts as a second factor: something you have. Even if someone steals your password, they would also need your phone to receive the code. This makes unauthorised access significantly harder, though SIM-swap fraud remains a risk.
What happens if someone steals my OTP?
A thief who intercepts an OTP can use it only once and only within its short validity window, from about 30 seconds for app codes to a few minutes for SMS codes. If you did not request the code, do not share it; contact your bank or service provider, because the thief may be trying to authorise a transaction.
Why do OTPs expire so quickly?
Short expiry limits the time an attacker has to intercept and reuse a code. If a code stayed valid for hours, a stolen SMS or email could be used long after the legitimate user has moved on. Expiry forces the attacker to act almost instantly.
Is an OTP the same as two-factor authentication?
An OTP is one common form of a second factor. Two-factor authentication means combining two different kinds of proof, such as something you know (a password) and something you have (a phone or hardware token). An OTP delivered to your phone supplies the second kind.
Can OTPs be intercepted?
Yes. SMS-based OTPs can be intercepted through SIM-swap fraud, where an attacker convinces the mobile operator to transfer your number to a SIM they control. App-based or hardware-token OTPs avoid the mobile network and are generally harder to intercept, though no method is perfectly secure.

Part of the guide: How the Internet Works →