TOTP (Time-Based One-Time Password)

What is TOTP?

TOTP (Time-Based One-Time Password) is a one-time verification code generated locally on a user's device using a shared secret and the current Unix timestamp, refreshing automatically every 30 seconds. TOTP is one of several second factors supported alongside delivered codes in platforms like BSG's 2FA/OTP Platform.

See BSG's 2FA, TOPT, Push-Based Authentication: Comparison for a closer look at how this plays out in practice.

How does TOTP work?

TOTP generates verification codes on the user's device without sending anything over a network. An authenticator app — Google Authenticator, Authy, or Microsoft Authenticator — uses a shared secret key (established during setup via QR code) combined with the current time to produce a 6-digit code that changes every 30 seconds.

How does TOTP compare to SMS OTP?

This approach eliminates the delivery dependency that SMS OTP carries. There is no SMS route to fail, no carrier latency, and no per-message cost. The trade-off is user friction: the user must install and configure an authenticator app before they can use TOTP, which limits adoption in consumer-facing flows where speed of onboarding matters.

When should businesses use TOTP?

In practice, TOTP works best as an optional security upgrade rather than a mandatory first step. Fintech and SaaS platforms typically offer TOTP alongside SMS OTP — letting security-conscious users opt into stronger protection without blocking less technical users at the gate. The RFC 6238 standard governs TOTP implementation, and most server-side libraries support it natively.