Glossary

OTP (one-time password)

An OTP (one-time password) is a short, automatically generated code that is valid for a single login, transaction or verification step and expires after it is used or after a short time window.

Updated 26 Sept 2026By PhoneBorn TeamEditorial policy

How it works

A service generates the code on its server, stores it (or a hash of it) with an expiry time, and delivers it through a channel the user controls. The user types the code back, the server compares it, and the code is then invalidated so it cannot be replayed.

There are two broad families:

Delivered OTPs — the server creates a random code and sends it by SMS, voice call, email or push notification. Typical length is 4–8 digits and typical lifetime is a few minutes.
Generated OTPs — an authenticator app and the server share a secret key and each compute the same code independently. TOTP (time-based, RFC 6238) changes every 30 seconds; HOTP (counter-based, RFC 4226) changes each time it is used. Nothing is transmitted, so there is no delivery delay.

Why it matters for phone verification

SMS OTPs are a very common way apps confirm that a person controls a phone number at sign-up. That makes the number the real credential: whoever receives texts on it can receive the code. Two practical consequences follow:

Delivery depends on the number type. Many services check whether a number is a real mobile line before sending a code, and some decline VoIP or landline numbers. See non-VoIP numbers.
The number must stay reachable. If a code is also used for later logins or recovery, losing the number means losing access.

PhoneBorn offers two options here: single-use OTP numbers for receiving one code for one service, and phone-number plans — real mobile numbers you keep while you renew — for accounts that will send codes again later. Acceptance is always up to each service.

Common pitfalls

Requesting several codes in a row. Usually only the newest code is valid, and repeated requests can trigger rate limits.
Letting the code expire. Enter it within the stated window; many services use 5–10 minutes.
Sharing the code. No legitimate support agent needs your OTP. Requests for it are a classic phishing pattern.
Treating SMS OTP as strong security. It is far better than a password alone, but it is exposed to SIM swap attacks; authenticator apps and passkeys are stronger second factors.

Put it into practice

OTP: FAQ

How long is an OTP valid?

It depends on the service. SMS and email codes are commonly valid for about 5 to 10 minutes, while authenticator-app codes (TOTP) rotate every 30 seconds. Once a code is used it is normally invalidated immediately.

Is an OTP the same as 2FA?

Not exactly. An OTP is a type of code; two-factor authentication is a login method that combines two different factors. An OTP is often used as the second factor, but OTPs are also used on their own for one-off checks such as confirming a phone number at sign-up.

Why did I receive an OTP I did not request?

Someone may have typed your number by mistake or may be trying to access one of your accounts. Do not share the code with anyone, and if it relates to an account you own, change its password and review its security settings.