One-time passwords (OTP) are a great way to provide a second factor of authentication to an application. They are commonly distributed through channels like SMS, voice call, email, or physical token generator - common with banks. Although very useful, each of those distribution channels have limitations on both side; for the user and for the application developer. For example, for the user, SMS or voice call needs network connectivity which isn’t always available, and from the application developer, we need to rely on third party SMS gateway or voice call gateway which don’t support all countries, making 2FA unavailable for some. HMAC-based OTP (HMAC) and later on Time-based OTP (TOTP) were algorithms invented to address those problems providing a way for a prover to generate a valid OTP without the need of the verifier to send it to the prover. In today’s post we will see an example of TOTP implementation and look at how it is constructed.