You have typed plenty of them: the six digits texted to your phone, the rotating code in an app, the number that lets you finish a login. That is a one-time password, and it quietly stands between your password and a stranger. Our GetMyPassword team explains what a one-time password is, how it protects you, and the one rule you must never break.
What a one-time password is
A one-time password (OTP) is a temporary code that works only once and only for a short time. It is used as a second step when you log in or confirm something important, on top of your usual password. Because it changes constantly and expires in moments, an OTP is useless to anyone who grabs an old one — its whole value is in being fleeting.
Why it protects you
An OTP turns your password into just one of two locks. Even if a thief steals or guesses your password, they still need the current code, which lives on your phone or in your app — not in any database they can breach. That is why turning on OTP-based two-factor authentication is one of the single most effective things you can do for an account.
Where OTPs come from
- Text message (SMS): easy and common, but can be intercepted or stolen through SIM-swapping.
- Authenticator app: a rotating code generated on your device, safer than SMS.
- Email: convenient, but only as secure as your email account.
- Hardware token or security key: a physical device, the strongest option of all.
A one-time password is yours for a few seconds and no one else’s, ever. No real bank, shop or service will ask you to read it out — anyone who does is trying to steal your account.
Two locks beat one
An OTP is powerful, but it works best on top of a strong first lock. Give every account a unique password from our password generator, then turn on two-factor authentication — preferably an authenticator app rather than text messages. And never, ever share a code with anyone who contacts you. Together, a strong password and a one-time code make your account a very hard target.
Frequently asked questions
What is a one-time password (OTP)?
It is a temporary code that works only once and for a short time, used as a second step when you log in or confirm something. Because it constantly changes and expires quickly, an old code is useless to anyone who steals it.
Is an OTP by app safer than by text?
Yes. An authenticator app generates the code on your device, while a text message can be intercepted or stolen through SIM-swapping. Where a service offers both, an app-based code is the safer choice.
Should I ever share a one-time password?
Never. A one-time password is for you alone. No genuine bank, shop or service will ask you to read out a code, so anyone who does — by call, text or email — is trying to take over your account.