What does TOTP stand for?
TOTP stands for Time-based One-time Password. A one-time code generated from a shared secret and the current time, usually changing every 30 seconds, by apps such as Google Authenticator or Microsoft Authenticator. Stronger than SMS codes, but device clocks must be in sync for codes to validate.
TOTP is the algorithm behind most authenticator applications. The server and the application share a secret, exchanged once, usually by scanning a QR code. Both combine that secret with the current time, divided into steps that are 30 seconds long by default, and compute a short code. Since both sides do the same calculation, the codes match without any network connection on the phone. The method depends on the two clocks agreeing.
TOTP in practice: an example
A user enrols an authenticator application by scanning a QR code on the account's security page. From then on the application shows a new six-digit code every 30 seconds, even in flight mode. After a long trip the phone's clock is several minutes wrong and the codes are rejected until the time is corrected.
What TOTP is confused with
TOTP vs HOTP: what is the difference?
HOTP derives the code from a counter that increases each time a code is requested, so a code stays valid until it is used. TOTP derives it from the time, so each code expires after its time step.
TOTP vs OTP: what is the difference?
OTP is any single-use code, including one sent by text message. TOTP is the specific time-based method that generates the code on the device itself. What OTP stands for
Which exams cover TOTP?
TOTP is on the official CompTIA acronym list for one of the four exams covered here.
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A user's authenticator codes are suddenly rejected on every attempt. What is the most likely cause?
- The phone's clock is wrong
- The phone has no mobile signal
- The password is too long
- The account has too much storage
Show the answer
A. The phone's clock is wrong. TOTP uses the current time as an input. If the phone and the server disagree by more than the allowed margin, the codes never match. A signal is not needed.
2. What do the server and the authenticator application need to share for TOTP to work?
- The user's fingerprint
- A secret key exchanged at enrolment
- The same Wi-Fi network
- The same screen size
Show the answer
B. A secret key exchanged at enrolment. Both sides compute the code from the shared secret and the time. Nothing else passes between them when a code is generated.
Sources: RFC 6238: TOTP: Time-Based One-Time Password Algorithm; Microsoft Learn: OATH tokens authentication method in Microsoft Entra ID. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.