OTP (one-time password)
Definition
A short code that is valid for a single login or verification and expires quickly.
OTP (one-time password), explained
A one-time password, or OTP, is a code that works once and then becomes useless. OTPs are sent by SMS or email, or generated by an authenticator app or hardware key. Most are four to eight digits and expire within a few minutes. Because each code can only be used once, a stolen password alone is not enough to sign in. The weak point is delivery: SMS OTPs can be intercepted through a SIM swap or tricked out of you with a smishing message. Legitimate services never call or text to ask you to read an OTP back to them.
Related terms
SMS verification
Confirming that you control a phone number by entering a code the service texts to it.
Authenticator app
An app that generates time-based login codes on your device, with nothing sent over the phone network.
Smishing
Phishing by text message: a fake SMS that tries to get you to click a link, share a code or send money.
Where you'll meet this term
What Is SMS Verification? How OTP Codes Work and Safer Alternatives
What SMS verification and one-time passcodes are, why sites use them, how codes are delivered, and how SMS 2FA compares to authenticator apps and passkeys.
Read the guide →Getting startedWhat Is an OTP Code and How Does It Work?
What an OTP code is, how one-time passwords are generated and sent, how long they last, and why you should never share one with anyone.
Read the guide →Getting startedHow to Get a US Phone Number From India to Receive OTP Codes
In India and an app only takes a +1 number? When a US number helps, why your card may fail abroad, how to enter it and why it's single-use.
Read the guide →DevelopersUsing virtual numbers to test SMS flows
How QA teams use real virtual numbers to test SMS sign-up and OTP flows end to end, when to use them vs test numbers, and how to automate with an API.
Read the guide →