What is an OTP SMS?
An OTP SMS is a text message that carries a one-time password: a short code, usually six digits, that is valid for one use and for a few minutes only. The person types it into a website or app to prove they hold the phone number they gave you. It is the most common second step in login, sign-up, payment and password-reset flows.
Why it caught on is simple. Nearly everyone has a phone that can receive SMS, it needs no app and no data connection, and users already know the routine. That is why banks, wallets, marketplaces and delivery apps still send millions of codes a day through OTP services like ours. This guide covers how an OTP works, how to build the flow securely, and what goes wrong in practice.
How OTP verification works, step by step
- The user asks for a code. They enter a phone number, or choose to sign in with the one on their account.
- Your server creates the code. It generates a random number with a secure generator, stores a hash of it with an expiry time and the user ID, and sets an attempt counter to zero.
- The code is sent by SMS. Your server calls an SMS API with the number, the template and the code. See our guide to the SMS gateway for what happens behind that call.
- The user submits the code. Your server hashes the submission and compares it with the stored hash, checks that it has not expired and increments the attempt counter.
- The code is cancelled. On success, or after too many failures, the stored code is deleted so it can never be used again.
The step people skip is the last one. A code that stays valid after it was used turns a one-time password into a reusable one.
OTP types: SMS, voice, WhatsApp, authenticator apps
SMS is not the only way to deliver a one-time code. Different methods suit different users and different levels of risk.
| SMS OTP | Voice OTP | WhatsApp code | Authenticator app (TOTP) | |
|---|---|---|---|---|
| Needs data | No | No | Yes | No after set-up |
| Reach | Almost every phone | Any phone that can take a call | WhatsApp users | Smartphone with an app |
| Set-up effort for users | None | None | None | Install and scan a QR code |
| Resists SIM swap | No | No | Partly | Yes |
| Cost per verification | Low | Higher | Low to medium | None per use |
| Best for | First line, wide reach | Fallback, accessibility | Users who prefer chat | Higher-risk accounts |
A time-based app code is generated on the phone using the TOTP algorithm defined in RFC 6238. Nothing travels over the network, which is why it avoids interception. For reach, though, SMS wins, and many teams use SMS first with a voice or WhatsApp fallback.
Is SMS OTP secure? The honest answer
SMS OTP stops the large majority of automated attacks on passwords, and for most consumer products it is a sensible choice. It has known weaknesses, and the US standards body NIST classes SMS as a "restricted" authenticator for that reason. Four attacks deserve a plan.
| Attack | How it works | What reduces it |
|---|---|---|
| SIM swap | A fraudster persuades the operator to move the victim's number to a new SIM and receives their codes | Ask your provider about a recent SIM-change check, and add a second factor for high-value actions. Background: SIM swap scam |
| Real-time phishing | A fake site asks for the code and relays it to the real one within seconds | Bind codes to the session, show the requesting app and location in the message |
| SMS pumping | Bots request codes to numbers the attacker profits from | Rate limits, destination allow-lists, bot checks on the request form |
| Brute force | The attacker guesses the six-digit code | Attempt limits, short expiry, lock after failures |
SMS pumping is an expensive surprise. A single unprotected sign-up form can generate thousands of messages in an hour. Limit requests per number, per IP and per account, and block countries you do not serve. Our OTP best practices article has a full checklist.
How to build an OTP flow correctly
- Use a secure random generator. Do not derive codes from the time, the phone number or an incrementing counter.
- Store a hash, not the code. If your database leaks, active codes should not.
- Expire quickly. Five minutes is a good default. Show the countdown and a resend button.
- Limit attempts. Three to five tries per code, then require a new one.
- Rate-limit requests. Cap how often a number can request a code, and add a cool-down of 30 to 60 seconds between resends.
- Keep codes out of logs. Mask them in application and support tools.
- Make the message safe to read. Include your brand name, the code and a line such as "Do not share this code". Never include a link that asks for the code.
Auto-fill for a smoother experience
Typing a code from a notification is the biggest source of drop-off. Both major phone platforms can fill it in for the user. On the web, add autocomplete="one-time-code" to the input. On Android, apps can use the SMS Retriever API, which expects a short hash at the end of the message. Keep the text short and predictable so that the extraction works.
Sending an OTP by API
You can send the code yourself as an ordinary templated message, or use an OTP endpoint that generates, sends and verifies the code for you. The second approach removes the code-storage and expiry logic from your own system.
# 1. Send a code
curl -X POST https://api.telnxo.com/v1/otp/send \
-H "Authorization: Bearer $TELNXO_KEY" \
-H "Content-Type: application/json" \
-d '{ "to": "+919812345670", "channel": "sms", "length": 6, "expires_in": 300 }'
# 2. Verify what the user typed
curl -X POST https://api.telnxo.com/v1/otp/verify \
-H "Authorization: Bearer $TELNXO_KEY" \
-H "Content-Type: application/json" \
-d '{ "id": "otp_8f2a", "code": "482913" }'The sending call returns an ID, and the verify call takes that ID and the typed code. Fields are listed in the API reference, and you can add a fallback channel so that, for example, a voice call follows an SMS that was not delivered.
OTP delivery: speed, routes and compliance
A code that arrives after it expires is a failed login. Three things decide delivery speed.
| Factor | Why it matters | What to do |
|---|---|---|
| Route quality | Direct operator routes are faster and more consistent than long reseller chains | Ask your provider about route type for your top countries |
| Priority | Verification traffic should not queue behind marketing campaigns | Send OTP on a dedicated route or sender ID |
| Registration | In India, OTP messages need a registered header and template; unmatched messages are dropped | Complete DLT registration first |
For a country-by-country view, check the rules for your sender ID before you launch, and keep the message in one segment with the segment calculator. Our OTP solution page shows typical patterns for fintech, e-commerce and logistics, and fintech teams in particular should read the section on step-up checks.
Monitoring your OTP traffic
Treat OTP as a product with numbers you watch daily: the share of codes delivered within 10 seconds, the share verified within the expiry window, and the number of requests per user. A sudden jump in requests from one country is nearly always fraud, and a fall in verified codes usually points to a delivery problem on one operator. Our analytics show both, and the webhooks let you feed receipts into your own alerts.
A good OTP is invisible when it works. Users notice only when it is late, so measure lateness.
Add OTP verification to your product. Send and verify codes by API, with fallback to voice or WhatsApp built in.
Frequently asked questions
What does OTP stand for?
OTP stands for one-time password, sometimes written one-time passcode or one-time PIN. It is a code that is valid for a single login or transaction and expires quickly.
How does an OTP SMS work?
Your server generates a random code, stores a hash of it with an expiry time and sends the code to the user's phone by SMS. The user types it back, the server checks it matches and has not expired, and then marks it as used.
How long should an OTP be valid?
Most services use between 3 and 10 minutes. Shorter windows are safer but frustrate users when delivery is slow. Five minutes is a common balance, with a clear resend option.
How many digits should an OTP have?
Six digits is the usual choice. Four digits can be guessed too easily without strict attempt limits. Longer codes are harder to type, so they only make sense with high-risk actions.
Is SMS OTP secure?
It is much better than a password alone, and it is not the strongest option. Attacks include SIM swapping, phishing sites that relay the code in real time and message interception on poorly secured routes. Authenticator apps and passkeys resist these better.
What is SMS pumping fraud?
Attackers trigger OTP requests to premium or high-cost numbers they control, so your account pays for messages nobody legitimate receives. Rate limits, destination allow-lists and bot checks on the request form prevent most of it.
Why is my OTP not arriving?
Typical reasons are a wrong number format, a handset with signal or storage problems, a sender ID or template that is blocked, or do-not-disturb filtering. Check the delivery receipt for the exact status before you resend.