What is a one-time password (OTP)?

  One-time passwords, or OTPs, are random strings of characters generated by a computer that authenticates the user for a single transaction or login session.

   The use of an OTP is more secure than traditional passwords, especially user-generated passwords, which can be weak and/or reused across multiple accounts. OTPs can be utilized either in place of or in addition to authentication login information.

An Illustration Of a One-Time Password

  A token-based OTP is a miniaturized smart card or pocket-sized key fob that generates a numeric or alphanumeric code to authenticate transactions or access to a system. Depending on how the token is configured, this secret code will change after 30 or 60 seconds.

  The Magento 2 Mobile Login is generated by a token device and a PIN when using mobile applications, such as Google Authenticator. Hardware, software, or demand-based OTP security tokens are available. As opposed to traditional passwords that remain static or expire after 30 to 60 days, one-time passwords are only required for one transaction or login session.

The Process Of Obtaining a One-Time Password

  The authentication manager on the network server generates a number or shared secret when an unauthenticated user attempts to access a system or to perform a transaction on a device. A security token located on a smart card or device uses the same algorithm and number to match and validate one-time passwords.

   Several companies provide temporary passwords via SMS as an authentication factor. User usernames and passwords are entered on networked systems and transaction-oriented web applications in order to obtain the temporary passcode out of the band.

One-Time Passwords: The Benefits

  The use of a one-time password helps IT administrators and security managers avoid common pitfalls associated with the security of passwords. There is no need for them to worry about composition rules, known-bad and weak passwords, sharing, or reuse of the same password across multiple accounts and systems.

  One other advantage of one-time passwords is that they are automatically invalidated after a certain period of time, thus preventing attackers from obtaining the secret codes and reusing them.