What Is OTP (One-Time Password)?

OTPs are generated with different methods. In time-based TOTP, the authenticator app on the user's device and the service provider use a shared secret key and the current time to generate six-digit codes that usually change every 30 seconds. In counter-based HOTP, the code is calculated with a counter that advances with each use. Codes sent by SMS or email are also common forms of OTP.

Cryptocurrency exchanges ask for an OTP when logging in, withdrawing funds, adding a new withdrawal address, and changing security settings. This way, even if the password is compromised, the attacker needs a second factor to access the account. This layer is a basic security measure that prevents a significant share of account takeover attempts.

Not every OTP method provides the same level of protection. Codes sent by SMS are vulnerable to SIM swap attacks, in which the attacker moves the victim's phone number to their own SIM card; for this reason, authenticator apps or hardware security keys are considered safer. OTP codes can also be requested by fake support teams or phishing sites; the code should never be shared with anyone under any circumstances.