OTP (One-Time Password / OTP code)
Definition
Three main OTP variants :
• OTP SMS : code sent by text message to the signer''s phone number. Most common on the consumer side because no application is required. Known vulnerabilities: SIM swapping, SS7 interception — which is why OTP SMS is sufficient for advanced signature (AES) but is no longer accepted for QES (ANSSI and ENISA have recommended since 2020 switching to stronger factors).
• OTP e-mail : code sent by e-mail. Easier to implement, but inherits the weaknesses of the recipient''s e-mail account security. Acceptable for simple signature (SES).
• TOTP (Time-based OTP) : code generated locally by an application on the signer''s phone (Google Authenticator, Authy, 1Password). Synchronized via a shared secret key at registration. No network channel at the time of signature — resistant to interceptions. Standard RFC 6238.
OTP and electronic signature : in advanced electronic signature, sending an OTP via e-mail or SMS creates a verifiable link between the signed document and the identity of the signer via their communication channel (phone or e-mail). The OTP is recorded in the document''s audit trail (timestamp, IP, channel identifier) — evidence that can be raised in case of dispute.
Certyneo implementation : OTP SMS via Twilio Verify on AES envelopes — triggered just before signature, valid for 5 minutes, 3 attempts. TOTP available for administrator accounts as an alternative to SMS OTP. See also MFA and strong authentication. Learn more about signer authentication →
Frequently asked questions
What is an OTP code?
An OTP (One-Time Password) is a single-use password, usually 4 to 8 digits, sent by SMS or email at the moment of a sensitive operation. It is only valid for a few minutes and can only be used once: even if intercepted after use, it is worthless. It is the most widespread mechanism for verifying that a person actually controls their phone or mailbox.
What is the OTP code used for in an electronic signature?
The OTP code ties the act of signing to an identified person: at signing time, the signer receives a single-use code by SMS or email and must enter it to validate the signature. This verification constitutes the strong authentication required for an advanced electronic signature (AES) under the eIDAS regulation. With Certyneo, the code entry is timestamped and recorded in the audit trail, which strengthens the evidential value of the signed document.
How do I receive my OTP code, and what if it does not arrive?
The OTP code is sent automatically by SMS to the signer's declared mobile number or by email to their address. If it does not arrive: check the number or address entered, wait one to two minutes (SMS can be delayed at peak times), check the spam folder for an email OTP, then request a resend. An expired code is never reusable — a resend always generates a new code.
What is the difference between OTP, TOTP and MFA?
The OTP is the single-use code itself, whatever its delivery channel (SMS, email). TOTP (Time-based OTP) is a variant generated locally by an authenticator app and renewed every 30 seconds, with no network needed. MFA (multi-factor authentication) is the overall strategy that combines several factors — password, OTP, biometrics — to verify an identity: the OTP is therefore one possible building block of an MFA setup.
Is SMS OTP secure enough for signing a document?
Yes, for the vast majority of contractual uses: the SMS OTP materialises the signer's sole control over their phone and feeds into a body of evidence (email, timestamping, audit trail, document fingerprint). To limit residual risks such as SIM swapping, Certyneo combines email and SMS OTP for the advanced signature. For the most sensitive deeds, the qualified signature (QES) with identity verification remains the recommended level.
Related guides
Related terms
Ready to put these concepts into practice?
Certyneo allows you to create eIDAS-compliant signature envelopes in just a few clicks, with no installation required.