Time-Based One-Time Passwords (TOTP)

Time-Based One-Time Passwords (TOTP) are temporary, one-time passwords generated using a shared secret and current time. Used in multi-factor authentication (MFA), TOTP enhances security by expiring within a short time window, reducing risks like credential theft and replay attacks. In Keycloak, TOTP can be configured as an additional authentication step, integrating with apps like Google Authenticator. It supports policy customization, including hash algorithms, token length, and expiration time. While TOTP increases security, it requires a device for code generation and may be vulnerable to phishing or SIM swap attacks if not properly managed.