TOTP Brute-Force Statistics

Mon, 09 Mar 2026 21:10:00 +0100

There is this tiny statistics problem in IT security that almost nobody talks about, yet I have seen people get it wrong many times in the past: Calculation of the success probability of brute-force attacks against TOTP two-factor authenticators.

As a reminder: TOTP tokens are defined in RFC 6238 ("TOTP: Time-Based One-Time Password Algorithm"). They usually consist of six-digit strings that change every 30 seconds. The entire sequence of tokens is derived from a secret (and the current time) in a way that makes token prediction without the secret impossible. TOTP tokens are commonly used as a second factor, in addition to a user’s password, reducing the impact of a potential password compromise.

Pentesting on Jonas Lieb

TOTP Brute-Force Statistics