One-time code
A one-time code is a temporary authentication credential accepted for a single attempt or operation, or during a limited validity period.
Software Security for Developers
A one-time password is an authentication code that is valid for a single use or a limited period.
- How it is used
- Supports passwordless login and multifactor authentication by providing a temporary verification key.
- How deep it goes
- Explains expiration, single use, delivery, risks, and implementation safeguards without descending into cryptographic protocol internals.
- Examples
- Uses six-digit codes delivered by SMS, email, or authenticator apps such as Google Authenticator, Authy, and Microsoft Authenticator.
- What you can do after
- Apply it by choosing safer delivery, expiration, generation, rate-limiting, monitoring, and invalidation practices.
Read how Software Security for Developers explains one-time code →
Real-World Cryptography
A one-time password is an authentication code intended to be accepted for only one authentication attempt or a narrowly defined validity period.
- How it is used
- Enables passwordless user authentication without sending a long-term symmetric key to the service.
- How deep it goes
- Explains symmetric-key derivation, HOTP counters, TOTP time values, registration, generation, and constant-time validation.
- Examples
- Uses Google Authenticator, six-digit 30-second codes, QR-code registration, and an example.com TOTP login flow.
- What you can do after
- Apply it via HOTP or TOTP to authenticate users without exposing their long-term symmetric keys.
Authorization in Action
A one-time password is a temporary authentication code intended to be accepted only once or during a limited validity period.
- How it is used
- Strengthens password-based login by adding possession evidence during multifactor authentication.
- How deep it goes
- Explains registration, factor binding, delivery methods, and security-usability trade-offs, but does not detail code-generation internals.
- Examples
- Uses SMS and email PINs, authentication-app codes, push notifications, and an identifier-and-factor login flow.
- What you can do after
- Apply one-time codes as possession factors and compare their phishing, interception, usability, and MFA-fatigue risks.
Related concepts
- password reset flowused by · A password reset flow is a process for replacing an account password, often after verifying control of the associated account.
- password authenticationcontrasts with · Password authentication is an authentication method that verifies a claimed identity or access by checking a supplied secret password or passphrase.
- multifactor authenticationuses · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
- HOTPincludes · HOTP is a one-time-password algorithm that derives authentication codes from a secret key and a counter.
- TOTPincludes · TOTP is a one-time-password algorithm that generates short-lived authentication codes from a shared secret and the current time.
- possession factorkind of · A possession factor is an authentication factor based on the claimant’s control of a required physical item or device.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.