You’ve typed a one-time password into a login screen more times than you can count. But have you ever wondered where that number actually comes from? OTPs aren’t random guesses pulled from thin air. Systems generate them using specific, well-tested methods designed to stay unpredictable yet verifiable.
Understanding the mechanics behind OTP generation helps explain why these codes expire, why they can’t be reused, and why some methods work better than others.
The Two Main Types of OTP Generation
Most OTP systems rely on one of two standardized algorithms:
HOTP (HMAC-based One-Time Password)
HOTP generates a code based on a shared secret key and a counter that increases by one each time you request a new code. The server and your device both track the same counter, so they stay in sync. Each time you generate a code, the counter moves forward, and the old code becomes invalid.
TOTP (Time-based One-Time Password)
TOTP works similarly to HOTP, but it uses the current time instead of a counter. Both your device and the server calculate the code using the same secret key and the current timestamp, typically rounded to a 30-second window. This is why TOTP codes in apps like Google Authenticator refresh automatically every 30 seconds, without you tapping anything.
Both methods rely on the same core idea: a shared secret combined with a changing value (a counter or a timestamp) that only the legitimate device and server know how to calculate correctly.
Why This Design Actually Matters
The math behind HOTP and TOTP follows published, peer-reviewed standards. The Internet Engineering Task Force’s RFC 4226 defines the HOTP algorithm, and RFC 6238 extends it into TOTP. These aren’t proprietary secrets each company invents independently. Most authenticator apps and verification systems build on these same open standards, which is part of why an app like Authy can generate valid codes for a completely different company’s login system.
This standardization matters for a few practical reasons:
- Predictable expiration. Since the code depends on time or a counter, both sides always agree on when a code stops being valid.
- No network dependency for TOTP. Because TOTP relies on time rather than a live connection to a server, your authenticator app can generate valid codes even without internet access, as long as the clock stays accurate.
- Resistance to replay attacks. Once you use a code, or once its time window passes, the same code becomes worthless. Someone who intercepts an old code gains nothing from it.
SMS-Delivered OTPs Work a Little Differently
When a code arrives by text message rather than through an authenticator app, the generation process usually happens entirely on the server side. The server creates a random or counter-based code, stores it temporarily, sends it to your phone, and checks it against what you type back. Your phone doesn’t calculate anything. It just displays whatever the server sent.
This is a meaningful difference from app-based TOTP, where your device independently calculates the same code the server expects, without needing to receive anything first. It’s part of why SMS-based OTPs depend on message delivery working correctly, while app-based OTPs work regardless of your signal or connection.
The Bottom Line
OTPs rely on established cryptographic standards, not arbitrary randomness. HOTP uses a counter, TOTP uses time, and both depend on a shared secret that only your device and the server know. Understanding this helps explain why codes expire, why old codes stop working, and why app-based and SMS-based OTPs behave differently in practice. For related reading, check our post on SMS verification versus OTP versus 2FA, or browse our full blog for more guides.
Frequently Asked Questions
Do OTP apps need an internet connection to work?
No, not for TOTP-based apps. Since TOTP calculates codes using time rather than a live server connection, your app can generate valid codes offline, as long as your device’s clock stays accurate.
Why do OTP codes expire so quickly?
Codes expire quickly to limit the window during which someone could intercept and misuse them. A short validity period, often 30 seconds to a few minutes, keeps that risk low.
Can two different apps generate the same OTP for my account?
Only if both apps have the same shared secret key, which typically happens when you scan the same QR code or enter the same setup key into multiple apps intentionally.
Is an SMS-delivered OTP generated the same way as an app-based OTP?
Not exactly. App-based OTPs (TOTP) get calculated independently on your device using time and a shared secret. SMS-delivered OTPs typically get generated on the server and sent to you, without your phone doing any calculation.
