What is a one-time password (OTP)? Meaning, generation and verification

Editorial team · updated 24 September 2026 · facts checked 24 September 2026

A one-time password (OTP) is a short code, usually six digits, that proves someone holds a phone, inbox or authenticator app. It is accepted once and expires within minutes. An authenticator app computes it from a shared secret (HOTP or TOTP), or your server generates a random code and sends it by SMS, email, WhatsApp or voice call.

A used code is dead, so an OTP leaked after sign-in is worthless, unlike a reused password. It isn't phishing-proof: NIST notes "an impostor verifier could relay an authenticator output" to the real site. In fandom slang OTP means "one true pairing"; this entry covers the security term.

How OTP codes are generated

NIST separates two families. An OTP authenticator (an app or hardware token) computes the code itself; a code your server creates and texts is an out-of-band secret (SP 800-63B-4, sections 3.1.3 to 3.1.5). App builders call both "OTP".

• HOTP (RFC 4226, 2005) hashes a shared secret with a counter, HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)), cut to at least six digits. The server checks a few counter values ahead to resync.
• TOTP (RFC 6238, 2011) swaps the counter for the current time step, 30 seconds by default. Most authenticator apps run it: the secret is shared once, usually by QR code, and nothing travels afterwards.
• Random codes are what SMS, email and WhatsApp OTPs are. NIST requires at least six digits from an approved random bit generator; OWASP asks for a cryptographically secure one. In app code that means crypto.randomInt() in Node.js or Python's secrets module, not Math.random(), which MDN says is not cryptographically secure.

How OTPs reach the user

App-generated codes need no delivery. For sent codes, NIST SP 800-63B-4 (final, July 2025) treats channels differently:

• SMS and voice: phone-network delivery "is restricted": allowed with an unrestricted alternative, a risk notice to users and a migration plan. OWASP cites SS7 interception, SIM swap and number porting.
• Encrypted messengers: NIST names no app, but accepts "an encrypted instant messaging service" such as WhatsApp without the restriction.
• Email: "Email SHALL NOT be used for out-of-band authentication"; codes that confirm an email address are exempt.

Cost, autofill and fraud risk per channel: our SMS vs WhatsApp vs email vs voice OTP comparison.

How long an OTP should stay valid

Minutes, once, with capped guesses:

NIST's reasoning: 100 guesses at a six-digit code succeed about once in 10,000 accounts. For your own code, OWASP adds: invalidate on success, don't log codes or keep them in long-term plaintext, and on resend issue a new code that overwrites the old one. Hashing only helps against short-lived leaks: a six-digit hash brute-forces quickly.

On Supabase, Email OTP expiration at 600 seconds matches NIST's window, but the same setting times out confirmation, recovery and invitation links. Its phone sign-in page contradicts itself: codes expire after one hour, and, further down, must be verified within 60 seconds.

OTP vs magic link vs passkey

• Magic link: a one-time sign-in link by email, as safe as the inbox (OWASP). Supabase runs magic links and email OTPs through the same method and expiry, and documents a failure: scanners such as Microsoft Defender's Safe Links open the link first, consume it and leave the user with "Token has expired or is invalid". Its first fix is an email OTP.
• Passkey: a WebAuthn credential unlocked with biometrics or a security key. Supabase calls passkeys "phishing-resistant"; NIST reserves that label for cryptographic authentication, which a typed code never is. Supabase marks its passkey support experimental and allows registration only after the email or phone is confirmed, by code or link.

What an OTP verification API does

OTP verification is the check: your backend compares the typed code with the one issued, inside its window and attempt limit. A verification API runs the whole cycle; Telnyx lists "code generation, delivery, expiration, and validation". Your database never holds the code. Four of the nine OTP APIs in our dataset, as their docs read on 24 September 2026:

Twilio charges $0.05 per successful verification plus the channel fee ($0.0083 per US SMS, pricing as of August 2026). Our OTP API rankings compare fraud controls, channels and price.

Doing it yourself takes a random code, a hashed record with an expiry, a failure counter and a send call; our SMS API tutorial for Node.js and Python covers the send. Either way, bots can request codes to number ranges whose carrier shares revenue with them (SMS pumping), billed to you; our vibe coding security checklist lists the limits that stop them.

Related guides

• SMS OTP vs WhatsApp, email and voice codes: cost and NIST status
• OTP and verification API rankings
• Vibe coding security checklist: SMS pumping
• How to send a text message with an API in Node.js and Python

About this guide

The PingMyUsers editorial team wrote this entry for developers adding sign-in or verification to an app; Sensaria AG in Switzerland operates the directory. Providers don't pay for placement, and none reviewed this page. NIST writes for US federal systems; we quote it as the most detailed public reference. To report an error, email contact@sensaria.ch with the source that shows the correct fact.

Methodology

On 24 September 2026 we read every source listed below: NIST SP 800-63B-4, RFC 4226 and 6238, OWASP, Supabase's Auth docs and four providers' verification docs. We did not send codes or open accounts. Section order follows 19 AI-search queries on this topic. Provider scores follow our methodology.

Last updated

24 September 2026: first version. Next re-check: March 2027, or sooner if NIST revises SP 800-63B or a listed provider changes its code rules.

Frequently asked questions

What does OTP mean?

One-time password: a code that works for one sign-in or action, then expires. NIST calls it a one-time passcode.

How long should an OTP be valid?

At most 10 minutes for codes sent by SMS, voice or push notification, accepted once, per NIST SP 800-63B-4. Authenticator-app codes change every 30 seconds under RFC 6238's default.

Is SMS OTP secure?

Adequate for most consumer sign-ins with rate limits. NIST calls SMS and voice codes "restricted"; OWASP cites SIM swap and SS7 interception and says they should not protect apps holding personal data or carrying financial risk.

What is the difference between HOTP and TOTP?

HOTP (RFC 4226) derives each code from a counter; TOTP (RFC 6238) from the current 30-second time step. Most authenticator apps use TOTP.

Is an OTP the same as 2FA?

No. Two-factor authentication needs two different factors, and an OTP is often the second after a password. Alone, as in passwordless sign-in, it is one factor.