OTP stands for one-time password: a short code, usually four to six digits, that proves you hold a phone number or device right now. A service sends it by text when you sign up, log in or confirm something, and it stops working once used or after a short time. If you get an OTP text, it is meant for you alone.
An OTP text, taken apart
A typical message reads something like: Your code is 482 913. Don't share it with anyone. Some add the app name or a link-free reminder that staff will never ask for it.
- The sender is often a short code or a name rather than a full phone number.
- The digits are the password itself. Type them into the screen that asked for them, nowhere else.
- The warning is part of the design: the code is only safe while you are the only one who knows it.
- On Android and iPhone, the keyboard may offer to fill the code in for you. That is the phone reading the text, not the sender.
OTP, verification code, 2FA and PIN: the differences
| What it is | Changes each time? | |
|---|---|---|
| OTP | Any password valid for one use | Yes |
| Verification code | An OTP that confirms a phone number or email | Yes |
| 2FA or two-step code | An OTP asked for after your password at login | Yes |
| Authenticator app code | An OTP your phone calculates from the time, no text needed | Yes, every 30 seconds by default |
| PIN | A secret number you choose and reuse | No |
The 30-second step is the default in RFC 6238, the standard behind time-based codes.
How many digits, and how long a code stays valid
| Digits | Sent by | |
|---|---|---|
| 6 | SMS or call | |
| Telegram | 5 | Inside Telegram, SMS or call |
| 5 | SMS | |
| 6 | SMS or call | |
| 6 | SMS | |
| Uber | 4 | SMS or call |
From the service facts on each service page.
Each service sets its own expiry and few publish it. Asking for a new code usually cancels the old one, so always type the most recent code, straight away.
When an OTP does not arrive
- Check the number and country code you typed.
- Look inside the app on your other devices: Telegram and Apple deliver codes there first.
- Wait a minute or two before asking again; repeated requests can lock you out for a while.
- Try the call option if the app offers one and your number can take calls.
The step-by-step fix by cause is in code not received. And if you need a code for a new sign-up without giving your own number, a one-time number does exactly one OTP.
Common questions
What does OTP mean in a text message?
One-time password. The digits in the text are a code that confirms your number or login, valid once and for a short time.
Is an OTP the same as a verification code?
Almost. A verification code is an OTP used to confirm a phone number or email address; OTP is the wider term.
Why did I get an OTP I did not request?
Someone typed your number into a form, by mistake or on purpose. Do not share it; if it repeats, change that account's password.
Can an OTP be used twice?
No. Once it has been accepted, or once a newer code has been sent, the old one stops working.