Time-based one-time password
authentication algorithm
Time-based one-time password (TOTP) is a computer algorithm that generates a one-time password (OTP) using the current time as a source of uniqueness. As an extension of the HMAC-based one-time password (HOTP) algorithm, it has been adopted as Internet Engineering Task Force (IETF) standard RFC 6238.
TOTP is a cornerstone of the Initiative for Open Authentication (OATH) and is used in a number of two-factor authentication (2FA) systems.
History
Through the collaboration of several OATH members, a TOTP draft was developed in order to create an industry-backed standard. It complements the event-based one-time standard HOTP, and it offers end user organizations and enterprises more choice in selecting technologies that best fit their application requirements and security guidelines. In 2008, OATH submitted a draft version of the specification to the IETF. This version incorporates all the feedback and commentary that the authors received from the technical community based on the prior versions submitted to the IETF. In May 2011, TOTP officially became RFC 6238.
Algorithm
To establish TOTP authentication, the authenticatee and authenticator must pre-establish both the HOTP parameters and the following TOTP parameters:
T0, the Unix time from which to start counting time steps (default is 0),
TX, an interval which will be used to calculate the value of the counter CT (default is 30 seconds).
Both the authenticator and the authenticatee compute the TOTP value, then the authenticator checks whether the TOTP value supplied by the authenticatee matches the locally generated TOTP value. Some authenticators allow values that should have been generated before or after the current time in order to account for slight clock skews, network latency and user delays.
TOTP uses the HOTP algorithm, replacing the counter with a non-decreasing value based on the current time:
TOTP value(K) = HOTP value(K, CT),
calculating counter value
C
T
=
⌊
T
−
T
0
T
X
⌋
,
{\displaystyle C_{T}=\left\lfloor {\frac {T-T_{0}}{T_{X}}}\right\rfloor ,}
where
CT is the count of the number of durations TX between T0 and T,
T is the current time in seconds since a particular epoch,
T0 is the epoch as specified in seconds since the Unix epoch (e.g.
Begin with the source’s own compact description: “Time-based one-time password” is authentication algorithm. The dossier treats that line as a proposition to test through Time-based, one-time and password, not as a finished interpretation.
Why this record matters
The phrase “authentication algorithm” supplies a clear boundary for inquiry. It also exposes the unanswered questions: who defined that boundary, when it became stable and which sources sit outside it.
Vocabulary and entity names are the principal evidence signals here, because they determine the precision of every later search. The source revision retrieved here is dated Aug 17, 2026. The linked authority identifier is Q166066. None of the 0 selected statements returned an explicit reference. The first chronological checks are 2008 and 2011.
Overview language is designed for orientation and should not be treated as a substitute for the evidence cited beneath it. The source lead contains qualifying language; that uncertainty should survive quotation, summary and reuse. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Use the entry as an orientation point, then follow its citations and revision history. Names, dates and institutional relationships should be checked against the original record.
- Subject orientation
- Search vocabulary
- Locating named sources
The closest primary source, responsible institution and strongest cited specialist reference.
Three-step research path
- Establish the record: confirm the title “Time-based one-time password”, its source revision and the description used here.
- Expand the search: follow Time-based one-time password primary sources, Time-based one-time password archive and Time-based research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “Time-based one-time password”?
- What terminology or title could unlock a more precise catalogue search?
- Which cited source is closest to the event, object or claim?
Search terms from this dossier
This entry incorporates text from “Time-based one-time password” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.