https://nalar.dev/tags/otp/ Recent content in OTP on Nalar Hugo en-us Sat, 19 Sep 2026 00:00:00 +0000 https://nalar.dev/email-otp-in-go-single-use-codes-expiration-and-replay-protection/ Sat, 19 Sep 2026 00:00:00 +0000 https://nalar.dev/email-otp-in-go-single-use-codes-expiration-and-replay-protection/ <h1 id="email-otp-in-go-single-use-codes-expiration-and-replay-protection">Email OTP in Go: Single-Use Codes, Expiration, and Replay Protection</h1> <p>An email OTP looks simple: generate six digits, send them, and compare what the user types. The security boundary is not the email API, though. It is the server-side challenge lifecycle.</p> <p>A correct implementation has to make the code unpredictable, expire it quickly, limit guesses, invalidate older challenges when appropriate, and guarantee that a successful code cannot be consumed twice. Those properties are different from TOTP, even though both mechanisms are commonly described as OTP.</p>