What Is an OTP Code, and Why Does Every Site Want to Send You One?

You know the drill. You type a password, the site says “we have sent a code to your phone”, and thirty seconds later six digits arrive that are worthless in another five minutes. That is a one-time password, almost always shortened to OTP.

What makes it “one-time”

An ordinary password is a shared secret that stays the same until you change it. Its whole security model rests on nobody else ever learning it — which, given how often password databases leak, is optimistic.

An OTP inverts that. The code is generated fresh, tied to one login attempt, and thrown away after use. Intercepting it a day later buys an attacker nothing. That is the entire idea: shrink the window in which a stolen secret is worth stealing.

Where the six digits actually come from

There are two common designs, and they are more different than the identical-looking six digits suggest.

Server-generated codes are what you get over SMS or email. The server picks a random number, stores it against your session with an expiry, and sends it to you. The code has no mathematical relationship to anything — it is just a random value in transit. The security depends entirely on the delivery channel being private.

TOTP codes — the ones in Google Authenticator, Authy, or 1Password — work differently. When you scan the QR code at setup, your app and the server agree on a shared secret. From then on both sides independently compute a code from that secret plus the current time, rounded to a 30-second window. Nothing is transmitted. Your phone could be in airplane mode and the code would still be correct. That is why TOTP works on a plane and SMS does not.

Why they expire so aggressively

A TOTP code changes every 30 seconds because the time window is baked into the algorithm. SMS codes typically last five to ten minutes, which is a policy decision rather than a mathematical one: long enough for a message to arrive over a congested network, short enough that a code sitting in a notification on a stolen phone goes stale quickly.

The short window also blunts brute force. A six-digit code has a million possibilities. If an attacker could try them all, they would break it in minutes — so servers combine expiry with rate limiting, usually locking the attempt after three to five wrong guesses. Expiry alone would not be enough, and neither would rate limiting alone.

The honest case against SMS codes

Security professionals have been trying to move people off SMS for years, and their reasoning is worth understanding even if you keep using it.

SIM swapping. An attacker convinces your carrier, through social engineering or a bribed employee, to move your number to their SIM. Your phone loses service, their phone starts receiving your codes. This is not theoretical — it is the standard playbook for high-value cryptocurrency theft.

The network was never designed for this. SS7, the signalling protocol that routes messages between carriers, dates from the 1970s and assumes every network on it is trustworthy. That assumption has not held for a long time.

Codes land on lock screens. Anyone holding your phone can often read the code without unlocking it.

The counterargument is real too: SMS 2FA is enormously better than no second factor, and it works for people who will never install an authenticator app. A weak second factor beats a missing one. But if a service offers TOTP or a passkey, take it.

Codes that are not really codes

Two variants confuse people. Magic links email you a URL that logs you in when clicked — the same one-time principle, wrapped in a link instead of digits. Push approvals send a prompt to an app you have already installed and ask you to tap yes. Push is stronger than SMS because approval is bound to a device that cryptographically identifies itself, but it has its own weakness: people tap “yes” reflexively. Attackers exploit that by firing prompts repeatedly at three in the morning until someone taps to make it stop.

If a code does not arrive

Usually the cause is not the code system at all — it is that the service refused to send to your number in the first place. We wrote up the reasons in why verification codes fail to arrive.