One-time passcodeOTP

A short code sent by SMS or email that expires quickly.

The service sends a code, often six digits, and the person types it in to prove they have access to the phone or inbox. After a short time, or after one use, the code stops working.

A single-use, time-bounded authentication value delivered out of band. Out of band means the code travels through a separate channel from the login itself, such as a text message or email.

One-time passcodes come from a few sources:

• Text or voice messages deliver the code to a phone number.
• Email delivers the code to an inbox.
• Authenticator apps and hardware tokens generate the code on the device, so nothing travels over the network.

One-time passcodes sit next to terms that are easy to mix up:

• Multi-factor authentication requires two or more different kinds of proof, while a one-time passcode is a single factor, something you have.
• Passkey replaces the password and the code with a cryptographic key tied to the real website.
• SIM swap is an attack in which a criminal convinces a carrier to move a victim's phone number to a SIM (subscriber identity module) card they control, which lets the criminal receive the victim's text codes.