By Alex Carter, Editor at GetVerifyCode
OTP means one-time password, also called a one-time passcode: a short code, usually 4 to 8 digits, that proves it's really you and works only once. Apps send it by text, email, voice call or an authenticator app, and it expires within minutes, so a stolen or old code is useless.
Key facts
- A temporary activation on GetVerifyCode stays live for about 20 minutes.
- If no SMS arrives before the timeout, the unused credit returns to your wallet.
- Top up your wallet from $1. Each number is priced live per service and country, and you see the quote before you confirm.
- GetVerifyCode covers 194+ countries and 1,600+ services.
What does OTP stand for?
OTP stands for one-time password. NIST, the US standards body, lists OTP as the acronym for one-time password in its CSRC glossary. Its digital identity guideline, NIST SP 800-63B, uses the name one-time passcodes and defines an OTP as "A secret generated by an authenticator and used only once to prove possession of the authenticator."
In plain words, an OTP is a code that only the person holding the phone, inbox or app should be able to see. Typing it in shows the app that you have that device right now. People also call it a verification code, a security code or a login code. Our guide to what a verification code is looks at the codes themselves, so this page sticks to what the term OTP means.
You may also see "OTP" in fan chats and comments, where it means "one true pairing". That's a different, unrelated use of the same letters.
How does an OTP work?
Every OTP follows the same basic pattern:
- You start a sign-in, sign-up, payment or password reset.
- The service creates a fresh code and sends it to a phone number, email address or app linked to your account.
- You type the code in before it expires.
- The service checks it and then treats it as used, so the same code can't be entered again.
Because each code works once and only for a short time, an OTP adds a second check on top of your normal password. If a code has already timed out, our guide on invalid or expired verification codes explains why it happens and what to do.
Types of OTP
SMS OTP
The most common kind is a text message with a short code, sent to the phone number on your account. It's easy because nearly every phone can receive texts, but it depends on signal and on the carrier delivering the message on time.
Email OTP
Some services send the code to your email address instead. It's handy when you don't want to share a phone number, though it can land in a spam or promotions folder.
Authenticator app OTP
Apps such as Google Authenticator or Microsoft Authenticator create time-based codes on your phone, usually a new 6-digit code every 30 seconds. NIST notes that the secret behind these codes "may be time-based or from a counter on the authenticator and verifier." Nothing is sent over the network, so these codes still work without signal.
Voice call OTP
If a text doesn't arrive, many apps offer to call you and read the code aloud. It's slower, but useful when texts are delayed or blocked.
OTP vs a normal password
A normal password is something you choose and reuse every time you sign in. An OTP is created by the service or your authenticator app, changes every time, and stops working after one use or a few minutes. That's why OTPs are often used as the second step in two-step verification: even if someone learns your password, they still need the fresh code.
OTPs aren't perfect. NIST states plainly that "OTP authentication is not phishing-resistant", which means a fake site or a scammer can still trick a person into typing in or reading out a code. The code only protects you while it stays private.
Where do OTP texts come from?
OTP messages usually arrive from a short code, a 5- or 6-digit sender number that businesses use for automated texts, or from a sender name such as the app's brand. Some come from an ordinary-looking long number instead. Our guide to 5-digit phone number short codes explains how these senders work. A genuine OTP text normally names the app and often warns you not to share the code.
Never share an OTP
No real bank, app or support agent needs you to read an OTP back to them. If someone calls, texts or messages asking for a code you just received, treat it as a scam and hang up. Only type a code into the app or website where you started the request, and only if you started it yourself. If you get a code you didn't ask for, don't share it, and change your password if you're worried someone has it.
Common OTP problems
- The code never arrives. Check signal, wait a minute, then request a new one. Our 12 fixes for missing verification codes cover the usual causes.
- The code says invalid or expired. Request a fresh code and use only the newest one.
- The app won't send to your number. Some apps refuse certain number types, such as VoIP, landline or toll-free numbers.
Receiving an OTP on a second number
If you'd rather not hand your personal number to a new app, a temporary number can receive the OTP for a single sign-up. On GetVerifyCode you pick the service and country, see the live quote and get a private inbox only you can see. To see the code once it lands, follow our guide on how to check an OTP sent to a virtual number, and read receiving SMS online for OTP verification for the full process. How GetVerifyCode works walks through each step.
Top up your wallet from $1. Each number is priced live per service and country. Some apps reject virtual numbers. Acceptance is decided by the app, not by us.
Using a temporary number to protect your privacy, travel, or test your own app is generally lawful in many places, but laws differ by country and each app sets its own terms. Check both. Never use it for fraud, impersonation, or getting around a ban. See are temporary phone numbers legal.
Related guides
- What is a verification code?
- How to check an OTP sent to a virtual number
- How to get a 5-digit phone number (short codes)
- Verification code invalid or expired?
- How GetVerifyCode works
Need a private number for a one-time code? Get started or check pricing.
About the author: Alex Carter is the editor at GetVerifyCode. Alex tests SMS verification routes across services and countries and writes plain-language guides on receiving OTP codes safely.
GetVerifyCode is not affiliated with the apps named in this article. Follow each app's terms and local law.
FAQ
FAQ
OTP stands for one-time password, also called a one-time passcode. It's a code that works once and expires quickly, used to confirm a sign-in, sign-up or payment.
OTP messages are texts or emails that carry a one-time code. They usually come from a short code or the app's sender name and often say not to share the code.
In a text from an app or bank, OTP means the one-time code you need to finish what you started. In a casual chat, OTP can mean "one true pairing", which has nothing to do with security codes.
It depends on the service. Many codes expire within a few minutes, and authenticator app codes usually change every 30 seconds. If a code stops working, request a new one.
No. Anyone who has your code may be able to sign in as you or approve a payment. Real companies don't ask you to read a code back to them.
Often, yes. Some apps let you use email or an authenticator app, and a temporary number can receive a one-time code for a single sign-up. Each app decides which numbers it accepts.
