What Is an OTP (One-Time Password) and How Does It Work?
An OTP is a short code that works for one sign-in and then expires. Here's what OTP means, how codes by SMS, call, email and app differ, how secure each one is, and how to use them safely.
8 min read
On this page· 11 sections
Key takeaways
- An OTP (one-time password) is a short code that works for one sign-in or transaction and then expires.
- A service either sends you the code (SMS, voice call, email) or your authenticator app generates it.
- App codes are safer than codes sent to a phone number. No OTP is phishing-resistant — a security key or passkey is stronger.
- Never share an OTP. A real service asks you to type it in, not to read it out.
- For everyday sign-ups, a second number can receive your OTPs so your personal number stays out of the form.
An OTP, or one-time password, is a short code — usually six digits — that works for a single sign-in or transaction and then expires. A service sends it to you or an app on your phone generates it, you type it in, and it can't be used again.
You already know OTPs under other names: verification code, security code, one-time code. This guide explains how an OTP works, the main types (SMS, voice call, email, authenticator app), how secure each one is according to NIST and CISA, and how to handle codes safely.
Most OTPs still arrive on a phone number. If you'd rather not hand your personal number to every app that asks, 2Phon — an iPhone app that gives you a real second phone number from dozens of countries — can receive those codes instead. More on that in our guide to receiving verification codes without giving out your real number.
What is an OTP?
An OTP is a password that is valid only once. Your normal password stays the same until you change it, so a stolen password keeps working. An OTP is made fresh for one sign-in, and it dies when you use it or when its time runs out.
That is the whole point. Even if someone sees an old code, it is already useless.
Services use OTPs in three common ways:
- To verify a phone number or email address when you create an account.
- As a second step when you sign in, after your password. This is two-factor authentication (2FA), also called multi-factor authentication (MFA).
- To confirm a sensitive action, such as a payment, a password reset or a new device.
How does an OTP work?
Either the service makes a random code and sends it to you, or your device and the service calculate the same code from a shared secret. Both ways end the same: you type the code and the service checks that it matches.
Codes the service sends to you
This is the kind you get by SMS, voice call or email.
You ask to sign in or sign up
You enter your phone number or email address, or your password if this is a second step.
The service creates a random code
It stores the code on its side, with an expiry time.
The code travels to you on another channel
It arrives as an SMS, an automated voice call or an email.
You type the code in
The service compares it with the one it stored. If they match and the code hasn't expired, you're in.
The code is cancelled
It can't be used a second time.
A typical code looks like this when it lands on your phone:
Your verification code is 482913. Don't share this code with anyone.
Code482913
NIST, the US standards agency, sets the baseline that many services follow. Its digital identity guidelines say a code sent this way must be at least six decimal digits and must be used within 10 minutes (NIST SP 800-63B, § 3.1.3.2). A service can choose a shorter window, which is why an old code may fail.
Codes your phone generates
An authenticator app doesn't wait for anything to arrive. When you set it up, usually by scanning a QR code, the app and the service save the same secret key. From then on both sides run the same calculation on that key and the current time, so they get the same code without talking to each other.
This method is called TOTP, a time-based one-time password. CISA, the US cybersecurity agency, describes authenticator apps as phone apps that "generate a new code every 30 seconds" (CISA). An older variant, HOTP, uses a counter instead of the clock, and the code changes each time you ask for a new one. Small hardware tokens with a number display work the same way.
Because nothing is sent, an app code works with no signal, and nobody can intercept it on the way.
Types of OTP: SMS, call, email and app
The types differ in how the code reaches you, and that decides how easy it is to steal.
| Type | How you get the code | Needs | Main weakness |
|---|---|---|---|
| SMS OTP | A text arrives on your phone number | A number that receives SMS | Depends on who controls the number (SIM swap), phishing |
| Voice OTP | An automated call reads the code aloud | A number that takes calls | Same as SMS |
| Email OTP | A code arrives in your inbox | Access to your email | Only as safe as the email account |
| Authenticator app (TOTP) | The app shows a code that changes on a timer | The app, set up in advance | Phishing; losing the phone without backup codes |
| Hardware token | A small device shows the code | The device | Phishing; losing the device |
A few notes on each:
- SMS OTP is the most common, because every phone can receive one and there is nothing to install. If a code doesn't show up, see our fixes for verification codes that don't arrive.
- Voice OTP is the usual fallback when a text fails. Here is how verification codes by phone call work.
- Email OTP is often used to confirm an email address or reset a password.
- Authenticator apps take a minute to set up and then work anywhere, even in Airplane Mode.
Is an OTP the same as 2FA or a verification code?
Not quite: an OTP is the code, and 2FA is the process that uses it. The terms overlap, so here is how they fit together.
- Verification code, security code, one-time code — everyday names for an OTP.
- 2FA / MFA — signing in with two or more different proofs, such as a password plus a code. An OTP is one possible second step. A fingerprint or a security key is another.
- Password — something you choose and reuse. An OTP is created for you and used once.
- PIN — a short number you choose and keep, like the one on a bank card. Not an OTP.
- Passkey — a newer sign-in method with no code to type at all.
How secure is an OTP?
An OTP makes an account much safer than a password alone, but not every OTP is equally strong, and none of them stops phishing. That is the shared view of the main US security bodies.
- Any second step beats none. CISA's position is that "any MFA is better than no MFA" (CISA). If a code by text is the only option an account offers, turn it on.
- Codes sent over the phone network are the weakest kind. NIST classes SMS and voice codes as a restricted method. A service that uses them must offer an alternative and explain the risk (NIST SP 800-63B, § 3.2.9). The main risk is that a criminal takes over the phone number itself, as in a SIM swap scam.
- Email is weaker still for sign-in. The same NIST guidelines say email must not be used for this kind of authentication, because an inbox is often protected by a password alone. Codes that only confirm an email address are a separate case.
- App codes are safer. The FTC notes that a code from an authenticator app can't be captured through a SIM swap (FTC).
- No typed code is phishing-resistant. NIST states plainly that "OTP authentication is not phishing-resistant": if a fake site or a caller talks you into handing over a code, it works for them. CISA says the only widely available phishing-resistant method is FIDO authentication (CISA) — the technology behind security keys and passkeys.
So the practical ranking is: security key or passkey first, authenticator app second, SMS or voice code third — and all of them ahead of a password on its own.
How to use OTPs safely
Type the code only into the app or site where you started, and tell it to nobody. A few more habits cover most of the risk:
Do
- Enter the code only on the screen where you asked for it
- Use an authenticator app, a security key or a passkey for email, banking and other accounts you cannot afford to lose
- Save the backup codes a service gives you when you turn on 2FA
- Keep the phone number on each account up to date
- Change your password if codes arrive that you did not request
Don't
- Read a code out to a caller, a buyer, a match or "support"
- Forward a code that a friend says was sent to you by mistake
- Tap resend again and again — too many requests can pause codes for your number
- Use a public "receive SMS online" number, where anyone can read the code
- Leave an old phone number on an account after you stop using it
Public inbox sites deserve a special warning: the code appears on a web page that strangers can open. We cover that in the risks of free "receive SMS online" sites.
Which phone number should receive your OTPs?
It depends on the account. A phone number that receives codes is a key to that account, so match the number to how much the account matters.
- Bank, main email, government services: use a number you will keep for years, and add an authenticator app or security key where you can.
- Everyday sign-ups — shopping, marketplaces, dating, delivery, social apps: a second number works well. The app gets a number, and your personal one stays out of its database.
Our guide to picking a phone number for verification compares the options in detail. For the sign-in side of this question, see should you use a second number for two-factor authentication.
Where 2Phon fits
2Phon is an iPhone app that gives you a real second phone number — a real mobile number, not VoIP — from dozens of countries. It does two things:
- Receives verification codes. SMS codes show up in the app with a push notification. Voice codes work too: choose "Call me instead" and the automated call rings on your 2Phon number.
- Makes and takes real calls, so the number is useful after the sign-up as well.
The limits, stated plainly: 2Phon is iPhone only, and it does not send text messages. The number is yours to keep while your subscription is active, and it may be released after that — which is why your bank belongs on a number you'll have for years. If a code is slow to arrive, the support page explains how to get help.
Get 2Phon on the App Store — a real second number for verification codes and calls, on your iPhone.
The short version
An OTP is a one-time password: a short code that proves it's you, once, and then expires. Codes sent by SMS, call or email are convenient; codes from an authenticator app are safer; a security key or passkey is safer still. Whatever the type, type the code in yourself and never pass it on. To keep your personal number out of sign-up forms, read how to receive verification codes safely.
Frequently asked questions
What does OTP stand for?
OTP stands for one-time password. It is a short code, usually six digits, that works for a single sign-in or transaction and then stops working. You may also see it called a one-time code, a one-time passcode or a verification code.
Is an OTP the same as a verification code?
In everyday use, yes. "Verification code", "security code" and "one-time code" are the names apps put on the screen, and OTP is the technical name for the same thing. All of them are short codes that work once.
Is it safe to share an OTP with someone?
No. An OTP is meant for you to type into the app or site you are signing in to, and nowhere else. Anyone who asks you to read out or forward a code is trying to get into an account, so treat it as a scam — see how the verification code scam works.
Which type of OTP is the most secure?
Codes from an authenticator app are safer than codes sent to a phone number or an email address, because they don't travel over the phone network. No OTP is phishing-resistant, though. For your most important accounts, a security key or passkey is stronger than any code.
Can I receive OTPs on a second phone number?
Yes, if the number can receive codes from the service. 2Phon gives you a real mobile number that receives verification codes by SMS and by voice call. It does not send text messages of any kind — it receives codes and makes and takes real calls.
Written by
2Phon TeamProduct & Privacy
The people building 2Phon. We write about second phone numbers, online privacy, verification codes, and getting the most out of the app.
Keep reading
All articles
Verification Codes7 min read
Verification Codes by Phone Call: How Voice OTP Works
Some apps read your one-time code out loud in an automated call instead of texting it. Here's why, how to ask for a call, and what to check if it never rings.
Verification Codes6 min read
Phone Number for Verification: How to Pick One That Works
The right phone number for verification is real, private, yours for the long run and able to take calls. Compare your options and match the number to the account.
Verification Codes2 min read
How to Receive Verification Codes Without Giving Out Your Real Number
One-time codes are everywhere — but you don't have to share your personal number to get them. Here's how to receive verification codes on a second number.