Glossary · definition
One time password (OTP): what it means and how it works
A one time password, or OTP, is a code that is valid for one sign-in or one action and then expires. You meet OTPs every day: the 6-digit text from your bank, the code in an authenticator app, the link a store emails you at checkout. This page explains the OTP meaning, how the codes are generated, and how to keep them out of the wrong hands.
Quick answer
What is an OTP?
An OTP (one time password) is a short code, usually 6 digits, that works for a single login or transaction and then expires, often within minutes. Services send it by SMS or email, or an authenticator app generates it. Because it changes every time, a stolen OTP is far less useful to an attacker than a stolen password.
What does OTP mean?
OTP stands for one-time password, sometimes written one-time passcode or one-time PIN. The idea is simple: instead of a secret you reuse for years, the service checks a fresh secret that is only good once. Even if someone watches you type it, the code is already spent.
In everyday speech, 'OTP code' and 'verification code' mean the same thing. An 'OTP number' usually refers to the phone number that receives the code, not the code itself. When an app says 'Enter the OTP we sent to your phone', it wants the digits from the text message.
How is an OTP code generated?
There are two broad families. In the first, the server creates a random code, stores it for a few minutes, and delivers it to you by SMS, voice call or email. You prove you received it by typing it back. This is how most sign-up verification works.
In the second, your device and the server share a secret key and each compute the same code independently. The IETF standardized the counter-based version as HOTP in RFC 4226 (2005) and the time-based version as TOTP in RFC 6238 (2011). TOTP mixes the secret with the current time in 30-second steps by default, which is why the code in Google Authenticator or a similar app changes every half minute. Nothing travels over the phone network, so there is no text message to intercept.
| Type | How you get it | Typical lifetime | Main weakness |
|---|---|---|---|
| SMS OTP | Text message to your phone number | A few minutes | SIM swap, interception, phishing |
| Voice OTP | Automated phone call reads the code | A few minutes | Same as SMS, plus voicemail access |
| Email OTP | Code or magic link by email | Minutes to an hour | Anyone with your inbox gets the code |
| TOTP (authenticator app) | Generated on your device from a shared secret | 30 seconds per code | Phishing; losing the device without backup |
| HOTP (hardware token) | Generated on a key fob each time you press it | Until the next code is used | Phishing; lost token |
Where do you see OTP codes?
OTPs show up any time a service wants proof that a real person controls a phone, an inbox or a device. The format is usually 6 digits, sometimes with a prefix such as G- for Google.
- Sign-up verification: WhatsApp, Telegram, Google and many other apps text a code to confirm a new account. See /sms-verification for how that step works.
- Login with two-factor authentication: a code after your password, explained in /glossary/two-factor-authentication.
- Payments: card issuers often send a code to approve an online purchase.
- Password resets: a code proves you own the recovery phone or email.
- Sensitive changes: adding a new device, changing your email or withdrawing funds.
Are OTP codes secure?
They are much safer than a password alone, but not all OTPs are equal. NIST Special Publication 800-63B-4 (final version, August 2025), the US federal digital identity guideline, requires codes delivered out of band to have at least six decimal digits and to be used within 10 minutes. It also classifies delivery over the public telephone network, which includes SMS, as 'restricted': services may use it but must offer an alternative and should weigh risk signals such as a recent SIM change or number port.
The same NIST document is clear that SMS and app codes are not phishing-resistant. A fake login page can ask for your code and relay it to the real site within seconds. Passkeys and hardware security keys are designed to stop that because they only respond to the genuine website.
The most common OTP attack is not technical at all. The FTC's 2021 alert on the Google Voice verification code scam describes strangers who text you a code and then ask you to read it back. Their rule is the right one: if you did not contact them first, never share a verification code with anyone.
How do you protect your one time passwords?
A few habits close most of the gaps attackers use.
- Never read a code to someone who calls or texts you, even if they claim to be your bank or the app's support team.
- Check the address bar before you type a code. Codes typed into a look-alike site go straight to the attacker.
- Prefer an authenticator app, passkey or security key for important accounts, and keep SMS as a backup only.
- Ask your carrier for a port-out PIN or number lock to make SIM swaps harder (see /glossary/sim-swap).
- If you receive codes you did not request, change that account's password: someone may already have it.
Can you receive an OTP on a temporary number?
Yes, for one-time sign-up verification. TempSMSVerify gives you a temporary number in 140+ countries that stays reserved for up to 20 minutes. The OTP text appears in your browser dashboard, your balance is charged only if the code arrives, and it is refunded automatically if it does not. See /how-it-works for the full flow.
Do not use a temporary number as the long-term 2FA method or recovery phone on an account you care about. Once the number expires, future codes go to a line you no longer control. Switch the account to an authenticator app or passkey right after sign-up, and only verify accounts that are yours, as our /acceptable-use policy requires.
FAQ
One-time password (OTP): FAQ
What is the full form of OTP?
OTP stands for one-time password. You will also see one-time passcode or one-time PIN; they mean the same thing. It is a code that works for a single sign-in or transaction and then expires, so reusing or stealing an old code does not let anyone into your account.
How long is an OTP code valid?
It depends on the service. Text and email codes usually expire within 5 to 10 minutes, and NIST SP 800-63B-4 (2025) treats an out-of-band code as invalid if it is not used within 10 minutes. Authenticator app codes change every 30 seconds by default under the TOTP standard. Request a new code if yours has expired.
Is an OTP the same as a verification code?
In practice, yes. 'Verification code', 'security code', 'OTP code' and 'confirmation code' all describe a short code that proves you control a phone, inbox or device. The difference is only context: sign-up codes confirm a new number, while login codes act as a second factor for an existing account.
Why do I need an OTP if I already have a password?
Passwords leak through data breaches, reuse and phishing. An OTP adds something an attacker usually does not have: your phone, your inbox or your authenticator app. Even if your password is exposed, the attacker still needs the current code, which changes every time and expires quickly.
Can someone steal my OTP?
Yes, in three main ways: tricking you into reading it out, sending you to a fake login page that relays it, or taking over your phone number with a SIM swap. You can block most of these by never sharing codes, checking the website address, adding a carrier PIN and moving important accounts to an authenticator app or passkey.
Which is safer, SMS OTP or an authenticator app?
An authenticator app is safer. Its codes are generated on your device, so they cannot be intercepted on the phone network or redirected by a SIM swap. The FTC recommends an authenticator app or security key over text codes when a service offers them. SMS is still better than no second factor at all.
Last updated:
Ready when you are
Get your verification code now
Create an account, top up and pick a number. Pay only if the code arrives.