One-time secret vs one-time password: what is the difference?

A one-time password is a code that proves who you are. A one-time secret is a link that delivers a credential to somebody else. They share most of a name and almost nothing else, and the overlap causes real confusion when people go looking for one and find the other.

The quickest way to keep them apart is to ask which way the thing is travelling.

one-time password   service  ---- code ---->  you       proves identity
one-time secret     you      ---- link ---->  someone   delivers a credential

One-time password: a code that proves identity

You have used these. You sign in, and before you are let through, a six digit code arrives by text message or appears in an authenticator app. You type it in. It works once, and usually expires within a minute or two.

Its job is to answer one question: is the person entering this password actually the account holder? A stolen password alone is not enough, because the attacker also needs whatever receives the code. That is why it is called a second factor.

Three things are always true of a one-time password:

• It comes to you, from a service you are already trying to use.
• It is about your own identity, not about anything you are sending.
• It is short and dies fast, because it only has to survive one login.

One-time secret: a link that delivers a credential

Now a different problem. You need to give a contractor a database password today. The obvious routes are all bad: a chat message stays readable by everyone who joins the channel later, an email sits in two mailboxes and in every backup of them, and a ticket gets indexed by search.

A one-time secret link solves that by making the credential temporary. You paste it into a service, get back a URL, and send that URL on. The recipient opens it, sees the password, and the record is destroyed. Opening the same link again shows nothing.

Three things are always true of a one-time secret:

• It goes from you to another person. It is a delivery method.
• It carries content, and that content is whatever you put in it.
• It has no idea who you are. On a well built service there is no account at all.

Where the confusion comes from

Both ideas grew out of the same instinct, which is that something used once is safer than something that lingers. The vocabulary then drifted. "One-time password" was claimed by the authentication world decades ago and is now effectively locked to login codes. When self-destructing link services arrived, the most accurate description of what they carry was, awkwardly, a one-time password.

So the same phrase points at two unrelated things depending on who is saying it. Search results are a fair illustration: a search for one-time password returns page after page about authenticator apps and login codes, with the link services scattered among them.

If you want to be unambiguous, say OTP code for the login number, and one-time link or one-time secret for the delivery kind.

TOTP, HOTP and the thirty second clock

Within one-time passwords proper there are two common schemes, and the acronyms turn up constantly.

• TOTP, time-based. This is what authenticator apps use. At setup, your phone and the service agree on a starting value once. After that, both sides compute the same code from that value and the current time. Neither needs to contact the other, which is why it works on a plane, and why the code rolls over every thirty seconds.
• HOTP, counter-based. The same idea with a counter in place of a clock. Each code advances the count. Used mostly by hardware tokens, and less common now because the two sides can drift out of step if codes are generated but never used.

Codes sent by text message are neither. They are generated by the service and posted to your phone number, which is the weakest of the three, because a phone number can be moved to another SIM by someone who convinces the network to do it. It is still far better than no second factor at all.

Which one you actually need

Two questions settle it almost every time.

Are you logging in? Then you want a one-time password, and specifically an authenticator app rather than text messages, on every account that offers the choice.

Are you handing something to another person? Then you want a one-time link. For a credential your team will use continuously, use a password manager with shared vaults instead, because a link that vanishes is the wrong shape for permanent access. There is more on choosing between them.

They are good together

These are not competing options, and a realistic handover uses both within a few minutes of each other.

You create an account for a new colleague. You send the temporary password through a one-time link rather than posting it into the team channel. They open the link, read the password, and it is destroyed. They sign in, and the service asks them to set up an authenticator app, which from then on issues a one-time password on every login.

The link handled the handover and then stopped existing. The codes handle every login afterwards. Different jobs, adjacent moments, similar names, and no real relationship beyond both being used once.