IT Glossary
What is OTP (one-time password)?
OTP (One-Time Password) is a password valid exactly once — a short code generated for one login or transaction, expiring within minutes and never reusable.
The six-digit code that arrives when you confirm an online payment has a property your ordinary password will never have: it dies the instant it is used. That is the one-time password — generated for one specific operation and valid for a few tens of seconds or minutes. Even if somebody intercepts it, the code is already worthless by the next attempt, which removes the fundamental weakness of static passwords, namely reuse and theft. The important differences sit in the delivery channel. SMS is the most widespread and also the most vulnerable, since messages can be hijacked by cloning a SIM card or read by malware sitting on the phone. Email inherits whatever security the mailbox has, which is frequently not much. Authenticator applications generate codes locally on the device from an algorithm and the current time, with no transmission for anybody to intercept at all. For a company building an application or an online shop, choosing the OTP channel is a genuine product decision: the balance between security, cost per message and customer convenience is what decides whether the protection is real or merely decorative.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247
Why it matters for your business
A stolen password stops being enough
A password leaked in somebody else’s breach no longer opens your customers’ accounts — without the code generated at that moment, authentication simply stops.
Firm confirmation of transactions
Binding the code to a concrete operation, with amount and beneficiary shown beside it, guarantees the customer approves exactly the payment they can see — a central requirement of strong authentication in European payments.
Lower support costs
One-time codes for resetting access and confirming sensitive actions reduce support calls about locked accounts and disputes over operations customers insist they never made.
Frequently asked questions
OTP by SMS or through an authenticator app — which should I choose?
The authenticator app is safer: the code is generated locally on the phone, never travels across a network and cannot be diverted by cloning a SIM card. SMS remains useful as a fallback and for less technical audiences, since any handset receives it with nothing to install. Many products offer both, with the app recommended by default and SMS positioned as the alternative.
How long is an OTP code valid, and why does it expire so quickly?
Typically between thirty seconds for app-generated codes and a few minutes for those sent by message or email. The short window is the protection mechanism itself: a code intercepted or read off a screen becomes useless before an attacker can act on it, while repeated guessing is stopped separately by limiting the number of attempts allowed.
Can an OTP system be tricked?
Yes, mainly through social engineering: an attacker phones pretending to be the bank and asks for the code you just received, and a code handed over willingly works perfectly. Hence the absolute rule that no bank employee or serious company ever asks for a one-time code by phone. Technically, binding the code to a device and displaying the operation context beside it reduces the risk further.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247