OTP, TOTP and passkey: Ilia Zavialov explains what each word covers

What a factor actually counts

Authentication sorts evidence into three categories: something you know, something you have, something you are. A password belongs to the first, a phone or an app secret to the second, a fingerprint that unlocks the device to the third. A second factor earns its name when it comes from a category other than the first, since defeating one category leaves the other standing.

This is why two passwords count as one factor used twice. A code sent to the same mailbox that the password opens sits close to that problem, since one break-in hands over both halves. The useful question about any second factor is which category it belongs to, and how easily that category moves into other hands.

OTP, TOTP and passkey all live in the possession category, and they differ in what you actually possess. With an OTP you possess a channel that delivers a number. With TOTP you possess a secret that produces the number on your device. With a passkey you possess a private key that never leaves the device. Everything else here follows from that difference.

OTP: a one-time password and the road it travels

OTP stands for one-time password. Among OTP, TOTP and passkey it is the oldest term and the loosest, because it describes a code valid once and only briefly, saying nothing about how that code was produced or delivered. In everyday use it means a number arriving by text message, by email or by a robotic call. The delivery channel decides how much the code is worth.

The strength of an OTP is easy to state. A password stolen from a leaked database stops being enough on its own, because the holder also has to reach your channel. The weakness is just as easy: whoever reads that channel reads the code, and a short number can be repeated aloud or pasted into a copied page while it is still alive.

That last property is why fake support desks work at all. Call-centre fraud, covering fake technical support and people posing as government services, produced over 80 thousand complaints and more than 2.9 billion dollars of reported losses in 2025, by the FBI Internet Crime Complaint Center count. A calm voice explains that the code confirms your identity, and the account owner reads it out.

TOTP: the same digits, produced by a clock

TOTP stands for time-based one-time password. During setup the site and your device agree on one shared secret, usually passed through a QR code shown once. The device then combines that secret with the current time and produces a fresh code on a fixed short interval. Nothing is sent to you.

A sibling term appears in the same menus. HOTP steps its counter on each use instead of following the clock, so its codes stay valid until they are spent. Both belong to the same family, and both keep the mobile operator, the text-message network and the mailbox out of the picture.

So TOTP removes the channel, and with it a class of problems including the SIM swap described below. It leaves two of its own. The code is still a number a person can be talked into reading aloud, and a copied login page can collect it and spend it inside its short life. The shared secret is a file too, so whoever photographs it during setup owns a second generator for good.

Passkey: a key pair that stays where it was born

A passkey is a pair of cryptographic keys created on your device at registration. The private half stays inside the protected storage of the device, and the public half goes to the site, where it is useless to a thief. At login the site sends a random challenge, the device asks you to unlock it, and it returns a signature. No reusable number crosses the wire.

The second property is the one worth memorising. A passkey is bound to the exact address it was created for, so the browser will not offer it to a lookalike domain with one letter changed. The person can be convinced by the page; the key checks the address and stays silent. Out of OTP, TOTP and passkey, only the last removes the human from the moment of verification.

The cost lands on recovery. Passkeys that synchronise between devices travel through the account of the phone or browser vendor, which makes that account the thing to guard hardest. Passkeys bound to one device never leave the hardware, so losing it means falling back to a second registered device or a stored code. Knowing which of the two you have is part of the definition.

The hardware key: possession you can hold

A hardware key, also called a security key, is a small object that plugs into a port or touches the back of the phone, and it holds the same kind of key pair a passkey holds. The difference sits in the housing. The secret lives in a chip you can put in a drawer, and a login needs a physical touch on it, which no remote attacker can perform.

Two consequences follow. Software running on an infected computer cannot extract what is inside the chip, because the chip never exports it. The key also verifies the site address the way a passkey does, so a copied login page gets nothing. Most keys ask for a PIN as well, so an object picked up from a desk is short of enough.

The honest drawback is logistics. A single key is a single point of failure, so accounts that matter deserve two, with the spare kept elsewhere. Enrolment repeats on every account, and some services still refuse keys entirely. That is the trade the term hides: the strongest verification available in exchange for housekeeping.

SIM swap: when your possession is reassigned

A SIM swap moves your phone number onto a SIM card held by someone else. It happens at a shop counter with forged documents, through a support agent who accepts a convincing story, or through an insider paid for the favour. From that moment every call and text intended for you arrives on their device.

The symptom is quiet and easy to miss. The phone loses network for no obvious reason and stays that way, while nobody can reach you. The right reaction is to call the operator from another line, confirm whether the number was reissued, then move every account that leans on text codes. Most operators offer a port-out PIN, and setting one takes minutes.

This term belongs in the dictionary because it defeats exactly one member of the family. An OTP sent by text arrives on the attacker's phone and works there. TOTP is untouched, since no message is involved, and the same holds for a passkey and a hardware key. Knowing which of OTP, TOTP and passkey depends on a phone number tells you which accounts to repair first.

Which factor closes which attack

Against a password leaked from a service database all three help, because the password alone stops being a complete answer. Against a copied login page the picture splits. A one-time code, delivered or generated, can be typed into the copy and relayed to the real site inside its window, while a passkey or a hardware key refuses the wrong address.

Impersonation is the volume behind those pages. The Federal Trade Commission counted over a million impersonation reports and 3.5 billion dollars of losses in 2025, close to one report in every three. In four of those reports out of five no money was lost, which says the attempts vastly outnumber the successes.

Voice pressure is the case where no factor helps on its own. A convincing voice clone can be built from around three seconds of recorded audio and reaches roughly 85 per cent accuracy, so a familiar voice asking for the code that just arrived is cheap. The defence sits outside the technology: a code is never read aloud to anyone, including a voice you recognise.

There is also the case where the second factor does its job and the money still leaves. UK Finance reports that 66 per cent of authorised push payment cases begin online and another 17 per cent over telephone networks, and in those the owner approves the transfer personally. Any of OTP, TOTP and passkey will confirm that approval faithfully. The vocabulary covers the door, and the decision to open it stays with the person.