The Time-based One-time Password algorithm (TOTP) is an extension of the HMAC-based One-time Password algorithm (HOTP) that generates a one-time password (OTP) by instead taking uniqueness from the current time. It has been adopted as Internet Engineering Task Force (IETF)[1] standard RFC 6238,[1] is the cornerstone of Initiative for Open Authentication (OATH), and is used in a number of two-factor authentication (2FA) systems.

Because of latency, both network and human, and unsynchronised clocks, the one-time password must validate over a range of times between the authenticator and the authenticatee. Here, time is downsampled into larger durations (e.g., 30 seconds) to allow for validity between the parties.

## Algorithm

To establish TOTP authentication, the authenticatee and authenticator must pre-establish both the HOTP parameters and the following TOTP parameters:

• T0, the Unix time from which to start counting time steps (default is 0)
• TX, an interval which will be used to calculate the value of the counter CT (default is 30 seconds)

Both the authenticator and the authenticatee compute the TOTPvalue, then the authenticator checks if the TOTPvalue supplied by the authenticatee matches the locally generated TOTPvalue. Some authenticators allow values that should have been generated before or after the current time in order to account for slight clock skews, network latency and user delays.

### TOTP value

TOTP uses the HOTP algorithm, substituting the counter with a non-decreasing value based on the current time.

TOTPvalue(K) = HOTPvalue(K, CT)

Calculating counter value

${\displaystyle C_{T}=\left\lfloor {\frac {T-T_{0}}{T_{X}}}\right\rfloor }$
 CT Count of the number of durations TX between T0 and T integer T Current time or Unix time integer T0 some epoch (eg. Unix epoch is 0) integer TX length of one time duration (eg 30 seconds) integer

Note that Unix time is not strictly increasing. When a leap second is inserted into UTC, Unix time repeats one second. But a single leap second does not cause the integer part of Unix time to decrease, and CT is non-decreasing as well so long as TX is a multiple of one second.

## Practical considerations

For subsequent authentications to work, the clocks of the authenticatee and the authenticator need to be roughly synchronized (the authenticator will typically accept one-time passwords generated from timestamps that differ by ±1 time interval from the authenticatee's timestamp).[1]

## Weaknesses and vulnerabilities

TOTPvalues can be phished like passwords, though this requires attackers to proxy the credentials in real time.[2]

An attacker who steals the shared secret can generate new, valid TOTPvalues at will. This can be a particular problem if the attacker breaches a large authentication database.[3]

TOTPvalues are typically valid for longer than 30 seconds so that client and server time delays are accounted for.[1]

## History

A TOTP draft was developed through the collaboration of several OATH members in order to create an industry-backed standard. It complements the event-based one-time standard HOTP, and it offers end user organizations and enterprises more choice in selecting technologies that best fit their application requirements and security guidelines. In 2008, OATH submitted a draft version of the specification to the IETF. This version incorporates all the feedback and commentary that the authors received from the technical community based on the prior versions submitted to the IETF.[4] In May, 2011, TOTP officially became RFC 6238.[1]