How One-Time Codes Work and Why They Expire So Fast

Six digits, valid for a few minutes, never to be reused. One-time passwords (OTPs) are everywhere. Two main kinds are in daily use, and they work quite differently under the hood.

SMS OTP. Generated by the server

1. When you ask for a code, the service generates a random number, often six digits.
2. It stores that code (ideally only a hash of it) with your account or session and an expiry time.
3. It sends the code to your phone number through an SMS gateway.
4. When you type it in, the service compares it with what it stored, checks it hasn't expired or been used, and deletes it.

The security comes from the delivery channel. Only whoever receives SMS for that number sees the code. That's why SMS codes are only as safe as the phone number itself.

TOTP. Generated on your device

Authenticator apps use TOTP (time-based one-time password, standardised in RFC 6238).

1. At setup, the service and your app share a secret key, usually by scanning a QR code.
2. Every 30 seconds, both sides combine that secret with the current time and run it through a cryptographic function to get a six-digit number.
3. When you type the code, the service computes the same thing and compares. Nothing is sent over the network until you enter it.

Because the code is computed on your device, TOTP keeps working without signal and doesn't depend on your phone number. It's also why your phone's clock needs to be roughly correct.

Why codes expire so quickly

• Limiting guesses. A six-digit code has one million possibilities. Short expiry plus a cap on wrong attempts makes guessing hopeless.
• Limiting theft. A code seen over your shoulder or in a notification preview is useless minutes later.
• Single use. Once accepted, a code is invalidated so it can't be replayed.

What codes can't protect against

Both SMS and TOTP codes can be phished. If you type a code into a fake site, the attacker can use it immediately on the real one. Passkeys and hardware security keys avoid this because they check the website's identity themselves. For important accounts, use them where available.

Where SMS codes still make sense

For sign-ups, SMS verification is mainly a check that a real, reachable phone number is behind a new account. For those one-off checks, a rented number from telly.cat works. The code appears on your dashboard within seconds, and you're refunded automatically if it never arrives.

FAQ

What is TOTP?

A time-based one-time password, the six-digit codes authenticator apps create every 30 seconds.

Why do verification codes expire so quickly?

Short expiry and limited attempts make guessing hopeless and stolen codes useless.