A Product Manager and Engineer's Guide to OTP Implementation

Aug 26, 2024

According to a 2022 report by IBM, data breach costs reached an average of $4.35 million, a 3% increase over the previous year. Yet, despite the increasing frequency and severity of data breaches, a significant number of companies still fail to implement common-sense security measures.

According to a 2023 survey by the Ponemon Institute, 64% of organizations have not fully implemented multi-factor authentication (MFA) across their systems and applications. This statistic is particularly alarming given that research shows MFA can prevent more than 99.9% of account compromise attacks

One-time passwords (OTPs) play an integral role in MFA, 2FA, and basic account security. OTPs are a simple, yet effective way to protect sensitive information and ensure secure transactions.

This guide provides an in-depth look at OTPs and equips product managers and engineers to implement and leverage security measures that protect users and technology platforms.

What does OTP stand for?

A one-time password, or OTP, refers to unique codes generated for use in only one login session or transaction.

OTP systems generate temporary passwords for authentication. These passwords are usually a series of numbers, such as “123456”. Their validity expires after a single use. These passwords are auto-generated by a trigger and sent to the user via email, voice call, WhatsApp,or SMS.

Why are OTPs better than static password generation?

Unfortunately, it’s common for someone to use the same static password (such as 123456) for ten different accounts. However, this practice leaves all ten accounts vulnerable to breaches. Poor passwords are the root cause of 81% of company breaches; 27% of hackers get in by guessing unoriginal and predictable passwords. Stolen and reused credentials cause 86% of hacking incidents.

OTP generation is instant and has only a single-time-use validity. Hackers can’t steal, guess, or reuse an OTP. When used in combination with one or more other login factors, OTPs are extremely effective in securing user accounts.

How do one-time passwords work?

OTP systems rely on “shared secrets” between the user's device (typically a smartphone app or hardware token) and the authentication server. A shared secret is a unique key that is known only to the user's device and the authentication server. It's typically generated during the initial setup of the OTP system.

When someone attempts to access an app or account that uses OTP authentication, the network server's protocol generates a series of characters or numbers (the shared secret) using OTP hash algorithms. A device or an authenticator app will send these single-use codes.

OTPs come in three main forms:

Time-synchronized OTPs: A hardware device or two-factor authenticator apps, such as Google Authenticator or Microsoft Authenticator, syncs the OTP device's clock with the authentication server's clock. Both generate a current-time-dependent OTP that gets hashed to create another unique numerical OTP. It uses a Unix timestamp to ensure universal time coordination, avoiding time zone issues.
Lockstep-synchronized OTPs: The HMAC-based one-time password (HOTP) method generates an OTP based on a previous OTP, using the older seed code to create a new seed code and hash chain. It’s hard to reverse-engineer and, hence, more secure against hacking. The OTP tool generates random, non-repeating passwords that prevent pattern recognition.
Transmission-based OTPs: This is the most common and well-known form of OTP implementation. Every OTP generates a new password and sends it to the end user via SMS, WhatsApp, email, or even voice call. It is also the easiest to implement for developers since an authentication server simply generates a random password and sends it to the user.

What are 2FA and OTP? How are they different?

Two-factor authentication (2FA) is a type of multifactor authentication system that requires two different types of verification before granting access to an account. These verification types are either:

Something you know, such as a password or PIN.
Something you have, such as a device like a mobile phone.

The idea behind 2FA is that a user's account remains secure even if the first factor (a static password) is compromised since the second factor remains intact.

OTPs are specific passwordless authentication tools within a 2FA system that provide an extra layer of security. The second factor isn;t always an OTP; it can be other passwordless authentication methods, such as biometric verification or hardware tokens.

How to implement OTP

Before outlining how to implement OTPs, it’s important to understand the mechanism behind OTP generation and verification.

Understanding OTP generation and verification

OTP systems integrate a PIN using a microprocessor-based smartcard, a token. These tokens generate numeric or alphanumeric codes that make the OTP authentication effective. The HMAC algorithms work with a variable parameter to generate these OTPs, such as time-based OTPs (TOTPs) and event-based OTPs.

Note: If you use TOTPs, a user who seeks access gets time-stamped OTP values that expire after a few seconds or minutes. The security token in the smart card uses the exact algorithm for verification and helps prevent replay attacks.

Implement OTPs in 4 steps with Plivo

Plivo’s Verify API enables you to start sending OTP verifications in under five minutes. Simply follow these steps to get started.

Step 1: Sign up with Plivo using your business email address.‍
Step 2: Set up an application in the Plivo console and get your API key and token to send and validate code.‍
Step 3: Verify the accessibility to the phone numbers you want to use to send verification codes.‍
Step 4: Install the required libraries into your development environment to use the Plivo API. Get the Plivo Software Development Kit (SDK) for your selected language: Python, Ruby, JavaScript, and other languages are all compatible with Plivo.

To summarize, create a Plivo account with an application. Define the right parameters, such as session expiry, log in attempts, length of OTP, etc. Get a library/module/SDK available in different programming languages from Plivo to make or direct HTTP requests to Plivo’s API.

Plivo protects your system from unauthorized access

Pilvo’s off-the-shelf solution makes it easy to go live in just one sprint. With built-in, complementary Fraud Shield and pre-registered sender IDs, Plivo’s Verify API handles security and compliance in one streamlined experience.

We manage the entire end-to-end process, from number procurement and sender ID and template registration to OTP generation, storage, and validation. Plivo boasts the market’s highest OTP conversion rates (95%) as well as the lowest cost per conversion. Our users do not pay monthly phone number rental fees, nor do they pay any extra fees for fraud control or verification.

[Learn more: Verify API - SMS and Voice OTP Verification]

3 Key benefits of one-time passwords

Enhanced security through unique, temporary codes

Algorithms generating OTP codes guarantee uniqueness; users can use each code only once. Users receive OTPs through email or text messages on their phone number, which only they can access and enter to verify their identities. The process prevents hackers from accessing user data for phishing, password sniffing, brute force attacks, and man-in-the-middle attacks.

Reduction in stolen passwords and password sharing

OTP authentication effectively mitigates common bad security habits, such as password reuse, weak passwords, and credential sharing. Since users can only use OTP once, it reduces the risk of stolen and reused login information. OTPs also prevent replay attacks by thwarting hackers who try to intercept and reuse valid data transmissions.

A frictionless user experience

The simplicity of use associated with OTPs hits the right balance between security and a great user experience. Customers can receive their code using their method of choice and type it in to complete the login process. In turn, IT administrators spend less time on password queries since OTPs automate password management.

5 best practices to implement one-time password authentication

As you implement a one-time passcode solution, keep these tips in mind.

Combine OTPs with 2FA and MFA: Integrate OTPs with other authentication mechanisms, such as biometrics or smart cards, for more secure user access.
Use cryptographically secure generators: Cryptographically secure random generators will send a new random OTP each time. No attacker can guess the new OTP by studying previous OTPs.
Provide backup options: Implement secure fallback mechanisms, such as backup codes or alternative authentication methods for users who cannot access their OTPs.
Limit OTP length: Balance security and user convenience by keeping OTPs six to eight digits long.
Regularly update systems: Review OTP systems to address new security threats and vulnerabilities.

How Plivo helps with OTP implementation

With its API, Plivo’s cloud-based communications platform can send codes to your customers worldwide. Automate sending and receiving SMS and voice OTP via over 1,600 carriers in 220+ countries and territories.

Here’s why Plivo stands out from other SMS OTP service providers.

High deliverability: We assure high delivery with our simulated handsets as test nodes and genuine phone numbers from regional carriers. The test nodes' responses enable our dynamic routing engine to route messages around delays to ensure deliverability.

Turnkey single-API solution: Simply integrate with Plivo using a single API to get started in five minutes or less.
Multichannel support: Plivo users can send OTPs using SMS, voice, and WhatsApp, with email and RCS messaging coming soon.
Carrier-specific routes: We employ intelligent routing to find ideal routes and phone numbers and ensure high deliverability. We also check sender ID and template compliance to avoid carrier failures.
Built-in fraud control: Plivo's Fraud Shield helps prevent and respond to potential cases of SMS pumping fraud. Set thresholds for different countries, determine your alert preferences, and curb fraud-related expenses with this free tool.
Support: Our premium service includes round-the-clock assistance, detailed documentation, seven worldwide points of presence, and 99.99% uptime SLAs.
No additional costs: Plivo offers simple pricing options that allow you to pay only for the resources you utilize. No fees are associated with authentication, regulatory compliance, fraud protection, or SMS verification. Get Volume Pricing to determine if an annual agreement is the right solution for you.
Best-in-class documentation: Our comprehensive documentation will address most of your questions and help you get started quickly.