What does OTP stand for?
OTP stands for One-time Password. A one-time password valid for a single login or a short time window, generated by an app or token (TOTP/HOTP) or sent by message.
An OTP is a code that is valid for a single sign-in or transaction. Because it changes every time, a code that is overheard or stolen cannot be reused later. Codes are produced by an authenticator application, a hardware token, or sent to the user by text message or email. An OTP normally serves as a second factor, proving possession of the phone or token, next to a password.
OTP in practice: an example
A user signs in to the company VPN with a password and is then asked for a six-digit code. She reads it from the authenticator application on her phone and types it in. An attacker who captured her password the day before cannot sign in, because the code he would need has long expired.
What OTP is confused with
OTP vs TOTP: what is the difference?
OTP is the general idea. TOTP is one way to generate the code, from the current time. HOTP is another, from a counter. What TOTP stands for
OTP vs MFA: what is the difference?
MFA is the requirement to use two or more different kinds of proof. An OTP is one common way to provide the second one. What MFA stands for
Which exams cover OTP?
OTP is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: 4.5 (Security Operations).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security). Listed there as “One-time Password/Passcode”.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Why does a one-time password protect against replay of captured credentials?
- It is longer than a normal password
- It is valid only once, so a captured code cannot be used again
- It is stored in the browser
- It never leaves the server
Show the answer
B. It is valid only once, so a captured code cannot be used again. The value of the code is that it expires after use or after a short time. Length has nothing to do with it.
2. Which delivery method for one-time codes is exposed to SIM-swapping attacks?
- A hardware token
- An authenticator application
- A text message
- A smart card
Show the answer
C. A text message. If a criminal persuades the mobile operator to move the phone number to another SIM, text messages arrive on the criminal's phone. Tokens and applications do not depend on the phone number.
Sources: NIST glossary: one-time password; RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm; NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.