OTP, 2FA, TOTP, MFA: a plain-English map of login security

Log into almost anything today and you will meet a small alphabet soup: OTP, 2FA, MFA, TOTP, sometimes HOTP for good measure. The terms get thrown around as if they were synonyms, which leaves a lot of people quietly unsure what they are actually turning on. They are not synonyms. Once you see how they fit together, the whole landscape becomes obvious — and you make better choices about protecting your accounts.

Start with the idea of a factor

Everything here is built on one concept: an authentication factor, which is simply a category of proof that you are you. There are three classic kinds, and the entire vocabulary is just combinations of them.

• Something you know — a password, a PIN, the answer to a security question.
• Something you have — your phone, a hardware key, an app that generates codes.
• Something you are — a fingerprint, a face scan, another biometric.

The reason factors matter is that combining different kinds is what makes an attacker's job hard. A password can leak; a phone can be stolen; but leaking a password and stealing the specific phone at the same time is a much taller order. That single insight is the whole point of the acronyms that follow.

MFA and 2FA: how many factors, from how many kinds

Multi-factor authentication, or MFA, means you must present proof from more than one of those categories. Two-factor authentication, or 2FA, is simply MFA with exactly two — the most common flavour by far. Every 2FA setup is MFA; not every MFA setup stops at two.

The subtlety people miss is that the factors have to come from different categories to count. A password plus a security question is two things you know — still just one factor in security terms, and barely stronger than the password alone. A password plus a code sent to your phone is a genuine two-factor setup, because it combines something you know with something you have. The count that matters is categories, not steps.

OTP: the code itself, however it arrives

A one-time passcode, or OTP, is the short code that proves the something you have — a number that authenticates a single action and then expires. Notice that OTP says nothing about how the code reaches you. It is the code, not the channel. That is why OTP shows up inside almost every 2FA setup: it is the mechanism that turns your phone or your app into the second factor.

MFA is the strategy — proof from more than one category. OTP is one common tactic for the something-you-have category. They live on different levels, which is why they are not the same word.

TOTP and HOTP: where the code comes from

Now the delivery. When you set up an authenticator app by scanning a QR code, you are provisioning a TOTP — a time-based one-time passcode. Your app and the server share a secret at setup, and from then on both compute the same six digits from that secret plus the current time. The code rolls over every thirty seconds, and it never travels over the network, because both sides can generate it independently.

otpauth://totp/OTP:[email protected]?secret=JBSWY3DPEHPK3PXP&issuer=OTP&digits=6&period=30

That string is what a setup QR code actually encodes: the shared secret, plus how many digits and how long each code lasts. HOTP is the older cousin that counts events instead of time — the code changes each time you use it rather than on a clock. Both are one-time passcodes; the difference is whether a ticking clock or a running counter drives the next value.

SMS OTP versus app OTP

An SMS one-time passcode is the same idea with a different channel: instead of your app computing the code, a server generates it and texts it to your number. The trade-offs are real and worth knowing rather than dogmatising about.

• SMS OTP needs no app and works on any phone, which is why it is the universal default and reaches the widest audience.
• App-based TOTP works offline and never transmits the code, which sidesteps interception and SIM-swap risks that touch SMS.
• Both are one-time codes, and both can be handed to a convincing phishing page by a careless user — the channel does not save you there.
• The right choice is stakes-dependent: SMS for the broad base of everyday accounts, an authenticator or hardware key for the handful that truly matter.

The whole map, in one breath

Put it together and the soup resolves. MFA is the goal of using more than one category of proof. 2FA is MFA with two. An OTP is a one-time code that supplies the something-you-have factor. TOTP and HOTP are two ways an app generates that code offline, by clock or by counter. SMS OTP is the same code delivered by text instead. Different levels of the same idea — and now that you can place each term, you can look at any login screen and know exactly what it is asking of you, and how much protection you are actually getting.