A one-time passcode, or OTP, is a single-use code used to confirm a user’s identity during sign-in or account recovery. It may be delivered by SMS, email, an authenticator app, or another verification system. OTPs improve security over passwords alone because the code expires quickly and cannot be reused after it is entered.
In cyber security, OTPs are common in multi-factor authentication and recovery workflows, but they are not automatically phishing-resistant. Attackers often target the person, not the system: they trick users into reading back or forwarding a valid code, then use it immediately to take over the account. Defenders reduce this risk by limiting code reuse windows, alerting users to unexpected login prompts, and preferring stronger methods such as passkeys or hardware-backed authenticators when possible.