One-Time Password (OTP)

One-time password (OTP) is a password that's valid for only a single login attempt or transaction, then automatically expires. It's commonly sent via SMS, generated by an authenticator app, or produced by a hardware token as a second authentication↗ factor.

Because an OTP can't be reused, stealing one is far less useful to an attacker than stealing a static password, which is why OTPs are a core building block of multi-factor authentication, even though app-based or hardware OTPs are more phishing↗-resistant than SMS ones.