Time-based One-Time Password (TOTP) is a multi-factor authentication code that changes at short, fixed intervals, usually every 30 seconds. It is generated from a shared secret and the current time, so the login code is only valid briefly and cannot be reused later.
TOTP matters because it adds a second barrier after a password, making stolen credentials much less useful. In real attacks, adversaries may try to phish a live code, hijack a session, or abuse access to the device or app that generates the token. That is why defenders often rotate TOTP secrets or reset tokens after suspected compromise, especially when an edge system or remote-access gateway may have exposed user sessions. TOTP is strong against simple password theft, but it is not magic: if an attacker can intercept a login in real time or control the authentication flow, the one-time code can still be bypassed.