Glossary · Cryptography & authentication
TOTP (time-based one-time password)
TOTP (RFC 6238) generates six-digit codes from a shared secret and the current time, giving accounts a second factor that changes every 30 seconds and works fully offline in any authenticator app.
Enrollment shares a random secret (the QR code); afterwards both sides compute HMAC(secret, time window) and compare. Because the code is valid for seconds and never travels until the user types it, database leaks of password hashes alone stop being sufficient for account takeover.
TOTP’s limits are worth knowing: codes can be phished in real time by a proxying attacker, and the server must store the shared secret (unlike passkeys, where it stores only a public key). It remains an excellent, vendor-neutral second factor — Ciphera ID offers TOTP alongside passkeys, with rate-limited verification.