OTP: definition and how it works
Published and updated
An OTP (one time password) is a short code valid for a single login or action and a short time, most often delivered by SMS to prove the user holds the phone number on the account.
How it works
An OTP flow has four steps. The server generates a random code, usually six digits, stores a hash of it with an expiry of a few minutes, and sends it to the user's phone number. The user types it back. The server compares, checks the expiry and the attempt count, and marks the code used so it cannot be replayed. Everything about a good implementation follows from those steps: the code is random, not derived from anything guessable; it expires; there is a limit on wrong attempts and on resends; and it is bound to the session that requested it.
SMS is the dominant channel because every phone can receive it with no app installed. It also has the weakest guarantees of the common channels. Delivery can be slow or fail on some routes, which is why the resend button and a sensible timeout matter more than the code itself. SIM swap and interception attacks exist, so SMS OTP is a second factor for ordinary accounts, not for high-value ones, where an authenticator app or a hardware key belongs.
Message design affects both delivery and conversion. Keep the text in one segment, put the code early, name the service, state the expiry, and never include a link. Many countries forbid links in OTP messages and filters penalise them.
Rate limit by phone number and by IP. OTP endpoints are a favourite target for SMS pumping, where an attacker requests codes to premium numbers at your expense.
How this applies with textbee
OTP is the most common textbee use. A code sent from a real local number arrives like a text from a person and gets a reply-capable sender. One phone drains roughly 10 to 15 messages a minute, so plan for that ceiling at login peaks or add a second device.
Related terms
- TOTP: TOTP (time-based one time password) is a code an authenticator app computes from a shared secret and the current time, so it works offline and needs no message to be sent.
- Delivery receipt: A delivery receipt is the network's report that an SMS reached the recipient's handset, or failed to, surfaced by a gateway as a status on the message.
- SMS segment: An SMS segment is one physical text message of up to 140 bytes, the unit that networks carry and providers bill, so a long or non-Latin message counts as several segments.
- Two-way SMS: Two-way SMS is messaging where recipients can reply to the number that texted them and the sender's software receives and acts on those replies.
Frequently asked questions
How long should an SMS OTP stay valid?
Long enough to survive a slow delivery, short enough to limit reuse. Five to ten minutes is the common range, with the code invalidated as soon as it is used or after a handful of wrong attempts.