What is TOTP?

A Time-Based One-Time Password (TOTP) is a short-lived numeric code generated from a shared secret and the current time, refreshed automatically every 30 seconds. An authenticator app produces it after a one-time QR-code scan, and it serves as a second authentication factor that proves the user holds a specific registered device.

Key takeaways

• TOTP proves a user holds a registered device, not just a password.
• Codes are derived from a shared secret and the current time step.
• An authenticator app generates codes offline after one QR-code scan.
• Codes typically refresh every 30 seconds, limiting replay attacks.
• Versa SASE Client and Concerto both offer TOTP as a second factor.

On this page: Why it matters · How it works · Types · TOTP & Versa · FAQ

Why is TOTP important?

Passwords alone are the weakest link in remote access: they get phished, reused, and harvested in credential-stuffing attacks. A second factor closes that gap by requiring proof an attacker cannot copy from a breach – that the user holds a specific device. TOTP delivers that proof offline: the code is computed locally from a secret the device already holds, so it keeps working even when SMS is delayed or intercepted.

Because TOTP is an open standard, any authenticator app can enroll the same shared secret and produce compatible codes, so organizations are not locked into one vendor’s app. That portability, plus resistance to interception, is why frameworks such as NIST SP 800-63B recommend TOTP, and why the Versa SASE Client offers it alongside certificate and SAML authentication.

What is TOTP?

TOTP is defined in RFC 6238 as a time-based variant of HOTP (HMAC-based One-Time Password, RFC 4226). Enrollment starts when the server generates a random shared secret and encodes it – typically inside a QR code – so the authenticator app can import it without the user typing a long string by hand.

To produce a code, the app divides the current Unix time by a fixed step (usually 30 seconds), computes an HMAC over the secret and that counter, and truncates the result to a short numeric string – normally 6 digits. The server performs the identical calculation and compares outputs, tolerating a small window of adjacent steps for clock drift. The code cannot be reused once its step expires.

Types of TOTP

TOTP is one branch of the OATH one-time-password family. HOTP (RFC 4226) is the event-based sibling: it advances a counter each time a code is requested, rather than tracking the clock, which suits hardware tokens with a physical button but can drift out of sync if a code goes unused. TOTP replaced the counter with time, keeping client and server synchronized automatically.

Within TOTP itself, deployments vary on three parameters: the hash algorithm (SHA-1 by default, with SHA-256 and SHA-512 as alternatives), the code length (6 digits is standard; some use 8), and the time step (30 seconds is typical; a few use 60). Delivery varies too – most rely on a phone app, but hardware security keys implement the same algorithm.

TOTP & Versa

The Versa SASE Client supports TOTP as one of its multifactor authentication options, alongside SMS- or email-based OTP and x509 certificate authentication, layered on LDAP, RADIUS, or SAML user authentication. TOTP is enabled from a Versa Director node (VOS Release 22.1.3 and later) or, in Concerto, from a Secure Client Access Rule: under Client Configuration, enabling MFA and selecting Time-Based OTP (TOTP) Authentication Service turns on time-based codes; Concerto Release 12.2.2 and later can also deliver the enrollment QR code by email.

During first-time registration, if TOTP is required, the client displays a QR code; the user scans it with any authenticator app and enters the resulting code to complete registration. See Use the Versa SASE Client Application, Use the Versa SASE Client with Concerto, and Concerto SASE End-to-End Configuration for the full workflow.

Frequently asked questions

What is the difference between TOTP and HOTP?

HOTP advances a counter each time a code is requested, so client and server can drift out of sync if codes are skipped. TOTP replaces the counter with the current time in fixed steps, keeping both sides synchronized automatically – why most authenticator apps implement TOTP.

How do I enroll a device in TOTP?

The server generates a shared secret and displays it as a QR code. Scanning it with an authenticator app imports the secret; the app then computes a fresh code every 30 seconds without any further network exchange with the server.

Why is TOTP considered stronger than SMS-based OTP?

TOTP codes are computed locally from a secret already on the device, so they cannot be intercepted in transit the way SMS messages can, including through SIM-swap attacks that hijack a victim’s phone number. TOTP also works without cellular or Wi-Fi connectivity.

What happens if my device clock drifts?

Because TOTP codes are calculated from the current time, a device clock too far from the server’s clock produces codes that no longer validate. Servers typically accept a small window of adjacent time steps to absorb minor drift; persistent skew requires resyncing the device.

How does Versa use TOTP for the SASE client?

The Versa SASE Client offers TOTP as a second factor during registration and login, configured from Versa Director or a Concerto Secure Client Access Rule. The client shows a QR code once; after scanning it, later logins just require the current TOTP code.

More on TOTP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about TOTP, these are worth looking at next.