What is OTP (One-Time Password)?

OTP (One-Time Password) refers to an authentication mechanism that uses technology to automatically generate a string of characters (typically a random number) that can only be used once, and then uses that string to perform authentication. While a regular password is used repeatedly, an OTP is a disposable password that is used only once after being generated — which is why it is called a "one-time" password.

Although OTP is written as "one-time pass‘word,’" it does not actually use uppercase letters, lowercase letters, or symbols — in most cases, it uses a sequence of digits (0-9). Generally, this numeric sequence is around six digits long.

Purposes and Use Cases for OTP

OTP is typically used in combination with password authentication to strengthen it. From an information security perspective, a password is a "knowledge factor" (something you remember, such as a string or sequence of characters) among authentication factors, whereas OTP is a "possession factor" (something you have, referring to the provided string or sequence). Using a password together with an OTP results in "multi-factor authentication," which combines multiple authentication factors and increases authentication strength — this is why adoption is increasing.

The following are several examples of how OTP is used together with passwords in real-world scenarios.

• Online Banking
  • Password
    Used when logging in. With only a password, users can check their balance and account information, but cannot transfer funds.
  • OTP
    Used when transferring funds to another account. Entry is required on the transfer screen.
• Cloud-Based Web Services
  • Password
    Used when logging in to the service. If the IP address matches the one used at registration, login with a password alone is possible.
  • OTP
    Used when accessing from a new IP address. When connecting from an IP address with no access history, OTP entry is required in addition to the password.
• Online Shops (E-Commerce)
  • Password
    Entered when using an online shop. If the credit card used for payment or the shipping address has been used before, OTP is not required.
  • OTP
    Used when registering and using a new credit card, or when shipping to a new address. OTP entry is required on the relevant screen.

Types of OTP and Their Differences

OTP uses an automatically generated string (in most cases, a numeric sequence), but there are various methods for delivering this OTP string to the user.

Dongle Type

Also called the "token type." This is a dedicated OTP device about the size of a USB memory stick, with a small LCD screen. Generally, a numeric sequence (OTP) of around six digits is displayed on the screen and automatically refreshed every few tens of seconds to a minute (the string continues to be refreshed as long as the dongle's built-in battery has power remaining). Because dongles are somewhat bulky and inconvenient to carry, some are provided in a card-shaped form instead.

A single dongle is typically linked to a single service, and the same dongle cannot display OTPs for different service providers. To use it, the user enters the string shown on the screen while it is still displayed to complete authentication. Once the string has been refreshed, entering the previously displayed string will no longer authenticate successfully.

The advantages are that the OTP can be read simply by looking at the LCD screen, no special operation is required, and no smartphone or phone line is needed, making it easy to use. On the other hand, the disadvantages are that a physical device (the dongle) is required, so authentication is not possible without it on hand, and the dongle itself could be stolen. In addition, from the perspective of a system or service operator, purchasing and distributing (shipping) the physical dongle devices incurs costs, making the implementation cost higher compared to other methods.

Email Type

This method sends an OTP to the user's registered email address when important information in an online service is being changed, or when unauthorized access is suspected due to use from an unusual IP address or device, and the user enters the OTP on the screen to authenticate. Only someone who can access the registered email account can receive the OTP by email and enter it.

The advantages are that no dedicated device is required, it can be used at low cost, and because it uses email, it can be received on either a computer or a smartphone. On the other hand, caution is required because if the email account has been hacked, the OTP could be intercepted.

Voice Call Type

This method delivers the OTP numeric sequence via an automated voice call to the phone number registered to the account, in situations such as changing account information, transferring funds, or accessing from an unusual environment. The user enters the OTP conveyed by voice on the screen to complete authentication.

Because mobile phones are so widely used, this method is available to nearly 100% of users, it also works with traditional feature phones (non-smartphones), and it requires no dedicated device, keeping implementation costs relatively low. The disadvantages include the fact that if the registered phone number's SIM card or the phone itself is stolen, the OTP can also be stolen, and if the user misses the voice message, they must receive the call again.

Authenticator Type (Smartphone App)

This method uses an Authenticator app on a smartphone to continuously display and refresh the OTP. It becomes usable by installing an Authenticator app on an iOS or Android smartphone and completing the initial setup in advance.

When an OTP is needed, the user opens the app and enters the displayed OTP on the screen to authenticate. Authenticator apps are provided by major IT companies such as Google and Microsoft, and a key feature is that a single Authenticator app can handle OTPs for multiple services. Note: in the Japanese app stores, these apps are offered under names such as "Google Authenticator" and "Microsoft Authenticator."

Since using Google's or Microsoft's Authenticator app is free of charge, the advantages include low implementation cost, no need for a dedicated device, and the ability for multiple OTP-based services to "share" a single Authenticator app. On the other hand, it cannot be used on traditional feature phones, and if the smartphone is stolen, the OTP could be viewed by someone else. There is also the disadvantage that re-registration when changing smartphones can be a complicated process.

SMS Type

This method sends an OTP each time using the mobile phone network. It can be used as long as a SIM card is inserted in the mobile phone and calls can be made. When an OTP is needed, the service sends an SMS containing the OTP, and the user enters the received OTP on the screen to authenticate.

The advantages are that it can be used not only on smartphones but also on traditional feature phones, and no dedicated device is required. However, because the security of the network used by SMS is weak, and malicious smartphone apps designed to intercept SMS messages are widespread, OTP delivered via SMS is considered to be security-vulnerable. For this reason, the U.S. National Institute of Standards and Technology (hereafter "NIST"), which develops information security guidelines, does not recommend using SMS-based OTP.

Future Trends in OTP

Adoption is expanding from password-only authentication to multi-factor authentication, which requires multiple authentication factors. Accordingly, the use of OTP as a means of implementing multi-factor authentication is also expected to expand.

・Reference Article
　The Multi-Factor Authentication Market to Grow at an Average of 15% Annually Through 2025

The most convenient and cost-effective method going forward is expected to be the Authenticator type, which has become affordable with the spread of smartphones and allows multiple OTPs to be handled by a single app. The email and voice call types, which likewise have low implementation costs and require no dedicated device, are expected to see similar growth in use.