A one-time password (OTP) is a single-use code that expires after a set time. Unlike fixed passwords, OTPs generate different codes each time, preventing reuse if intercepted. They serve as the "possession factor" in two-factor authentication.
Three main delivery methods exist. First, SMS sends 4-6 digit codes, the most common method for banks and online services. Second, authenticator apps (Google Authenticator, Microsoft Authenticator) generate new TOTP (Time-based OTP) codes every 30 seconds. Third, dedicated hardware tokens display codes on keychain-sized devices. If you choose an authenticator app, note that forgetting to migrate it when you replace your phone can lock you out of your accounts; storing the provider-issued backup codes somewhere separate is the practical safeguard.
SMS OTP has vulnerabilities. SIM swap attacks that hijack phone numbers redirect OTPs to attackers. "Real-time phishing" via smishing relays user-entered OTPs to attackers instantly. Authenticator apps are more secure than SMS OTP.
Watch for OTP-exploiting scams: "This is bank security. Please read back the number we just sent." If a caller asks for an OTP, do not give it, even if they claim to be your bank. See two-factor auth phone risks for detailed analysis.