OTP (one-time password)

A short code valid for a single login or verification, typically 4-8 digits delivered by SMS, voice call, or generated by an app.

An OTP is a code that works once and then expires. In SMS verification the service generates the code, texts it to the number you gave, and compares what you type against what it sent. Validity windows are short, usually one to ten minutes.

OTPs delivered by SMS are convenient because every phone can receive them. OTPs generated locally by an authenticator app are stronger, because nothing travels over the phone network where it could be redirected.

Why codes are four to eight digits

Length is a trade between guessability and patience. Four digits give ten thousand combinations, six digits give a million, and services pair the short length with a rate limit and a short expiry so guessing is impractical.

Six digits is the common choice for sign-up flows. Some services send four, a few send eight, and a handful send a word or a link instead. The digit count tells you nothing about how the message was routed or how fast it will arrive.

Reading a code from a rented number

When you rent a number, the code appears in the dashboard beside the activation, along with the full message text so you can see which sender it came from. Developers poll the same event through the API, which is what the Python and Node.js examples do.

If nothing arrives before the window closes, the activation cancels and the charge returns automatically. Codes that show up after that point are not delivered to you, since the number has already moved on.