SMS OTP Explained: How One-Time Passcodes Work

What a One-Time Passcode Is

A one-time passcode (OTP) is a credential that is valid for a single use and a short window. The service generates a random code, stores a hash of it with a timestamp, and sends it to a channel it believes only you control. When you type the code back, the service compares it with the stored value, checks the timestamp, and marks it used. Entering the same code again fails even inside the window.

The code proves possession of the channel, not identity. A 6-digit SMS code says "whoever typed this can read messages sent to +44 7700 900123." It does not say who that person is. That distinction matters later when we talk about what a temp number is and is not appropriate for.

Most OTPs are numeric because they are typed on a phone keypad. Some services use alphanumeric codes or a magic link instead of a code, but the mechanism is the same: a secret, a channel, a time limit, and a single use.

Why Services Send Them

Services send OTPs for two different reasons and it helps to keep them apart. The first is signup verification: the platform wants to know the phone number is real and reachable before it creates the account. This raises the cost of mass account creation, gives the platform a recovery channel, and on apps like WhatsApp and Telegram the number is the account identifier itself.

The second reason is authentication after the account exists. A code on login, on a new device, or before a sensitive action such as changing a password or withdrawing funds is two-factor authentication (2FA). Here the number is a long-term security control, and losing access to it means losing access to the account.

The same 6-digit text serves both purposes, which is why people confuse them. A temp number is a good fit for the first case and a poor fit for the second, and the rest of this article explains why.

SMS OTP vs TOTP vs Push Approval

Three second factors dominate consumer services, and they differ in where the secret lives and how it travels.

SMS OTP: the server generates a random code and sends it over the carrier network. The secret is created per request and travels in plain text through the SMS aggregator, the carrier, and the handset. Anyone who can intercept or redirect that message, through SIM swap, SS7 exploitation, a malicious app with SMS permissions, or a shared public inbox, can use the code.

TOTP (time-based one-time password): the server and your authenticator app (Google Authenticator, Authy, 1Password, Aegis) share a secret once, at enrollment, via a QR code. After that, both sides compute the same 6-digit code from the secret and the current 30-second time slot. Nothing is transmitted at login time, so there is nothing to intercept. The weakness is the enrollment secret and the device it lives on.

Push approval: services such as Microsoft Authenticator, Duo, Okta Verify, and Apple's trusted-device prompts send a notification to a registered device and you tap Approve. It is convenient and resistant to interception, but vulnerable to "MFA fatigue," where an attacker triggers prompts until the user taps yes. Number matching, where you type a digit shown on the login screen, was added to fix that.

Hardware keys (YubiKey, passkeys on a phone) are stronger than all three because they verify the site origin, but they are outside the scope of this guide.

Why SMS Is Both the Most Common and the Weakest

SMS won on reach. Every phone on earth can receive a text without installing anything, and a phone number is something the platform can also use for marketing, recovery, and abuse control. For a company optimising signup completion, the text message is the path of least friction.

It is also the factor security teams keep trying to retire. NIST deprecated SMS as an authenticator in draft guidance back in 2016, and the reasons have not changed: SIM-swap fraud, where an attacker persuades a carrier to move your number to their SIM; SS7 routing attacks; number recycling, where a carrier reassigns a lapsed number to a stranger; and phishing pages that relay the code in real time. Every major crypto exchange breach story of the last few years has a SIM swap in it somewhere.

The practical position is: SMS is fine for proving a number is reachable at signup, acceptable as a fallback, and a bad choice as the sole 2FA on anything with money or identity in it. Our guide on 2FA without a phone at /blog/two-factor-authentication-without-phone covers how to move an existing account to TOTP.

Code Length, Expiry Windows, and Rate Limits

Code length is a trade-off between guessability and typing errors. 4 digits gives 10,000 combinations and is only safe with tight attempt limits; Telegram and some banking apps still use it. 6 digits (1,000,000 combinations) is the industry default and what Google, WhatsApp, Meta, Twilio Verify, and Apple use. 8 digits appear on higher-value flows such as some payment confirmations and Microsoft account recovery.

Expiry windows range from about 30 seconds on aggressive implementations to 10 minutes on lenient ones. Twilio Verify defaults to 10 minutes. WhatsApp's code is valid for a few minutes with a visible countdown before you can request another. Google typically allows around 5 minutes. TOTP codes rotate every 30 seconds by design, which is why authenticator apps show a timer. A code that arrives after its window fails with a message like "code expired," and the fix is always to request a new one, not to retry the old one.

Rate limits sit on two sides. On the request side, most platforms allow 2 to 5 code sends per number in an hour, with the wait between resends growing each time; WhatsApp and Telegram escalate to multi-hour lockouts after repeated requests. On the entry side, 3 to 10 wrong guesses usually invalidate the code or lock the flow. This is why a public shared inbox is a poor place to receive OTPs: if 20 people have tried the same number on the same service that day, the rate limit may already be exhausted before you start.

• 4 digits: legacy and some messaging apps; only safe with strict attempt limits.
• 6 digits: the default for Google, WhatsApp, Meta, Apple, Twilio Verify, most banks.
• 8 digits: higher-value confirmations and some recovery flows.
• Typical expiry: 30 seconds (TOTP) to 10 minutes (Twilio Verify default); most consumer SMS codes sit at 3 to 5 minutes.
• Typical resend limit: 2 to 5 sends per hour per number, with escalating cooldowns.

Why Codes Fail to Arrive

When a code does not show up, the failure is almost always in the delivery path rather than the code itself. Application-to-person (A2P) SMS travels from the platform through an aggregator (Twilio, Sinch, Infobip, Vonage) to the destination carrier, and each hop can drop it.

Carrier filtering is the biggest cause. Carriers run content and volume filters on A2P traffic, and codes from a sender the carrier has flagged, or on a route the carrier has throttled, get silently discarded. There is no bounce message. The US requires 10DLC registration for A2P senders, and unregistered traffic to US numbers is blocked or heavily throttled; South Korea, Russia, and China apply some of the strictest inbound filtering anywhere, and international OTPs to those countries fail at a noticeably higher rate.

Route choice matters too. Some platforms send OTPs over cheaper "grey" international routes that use ordinary SIMs rather than registered A2P connections; those routes are unreliable and get shut down by carriers without notice. A platform can also cache a failed number and refuse to resend for a period. Our troubleshooting guide at /blog/sms-not-arriving-troubleshooting walks through what to check, in order, when a code is missing.

On the receiving side, a number that is mid-port, out of credit on a prepaid plan, roaming on a network that blocks A2P, or a VoIP range the platform refuses to send to will all produce the same symptom: nothing arrives. Voice call fallback, where the platform reads the code aloud, gets around some carrier SMS filters but not a VoIP block.

Where Temp Numbers Fit

A temp number is a real mobile number on a real carrier range that you rent for a short window and read in a web dashboard. For signup verification it does exactly what the platform is checking for: it is reachable, it receives the code, you type it in, the account is created. TempNumber.me numbers are private for the activation window, so nobody else has tried them on the same service that hour and the rate limit is yours alone. Compare that with a public inbox site, where the number is printed on a web page, has been used on every major platform hundreds of times, and is frequently already banned or rate-limited before you copy it.

The same property that makes a temp number good for signup makes it wrong for 2FA. The activation lasts 10 to 20 minutes and a rental lasts days or weeks; a bank, a crypto exchange, or a Google account you rely on will ask for that number again in six months. If the number has expired, the recovery path is gone. Use a temp number for the one-time gate, then move the account's second factor to an authenticator app or a number you control long term.

The rule of thumb: temp numbers for signup verification on accounts you could walk away from; TOTP or a persistent number for anything you must be able to recover. The verification landing page at /phone-number-for-verification lists which services and countries are available.