OTP stands for one-time password: a code that works only once and only for a short time. The 4 to 8 digit codes you receive when logging in to an app, confirming a payment or creating a new account are usually OTPs. Because each code expires within minutes, a stolen code is usually useless by the time someone tries to reuse it.
OTP meaning in plain terms
A regular password stays the same until you change it. An OTP is generated fresh for each login or transaction and becomes invalid once it's used or expires. That short lifetime is the whole point: it limits the damage if a code is intercepted.
You'll also see OTPs called verification codes, security codes, one-time passcodes or login codes. They all describe the same idea.
How OTP codes are delivered
| Method | How it works | Where you'll see it |
|---|---|---|
| SMS OTP | The platform generates a code and texts it to your phone number. | Banking, app sign-ups, account recovery |
| Authenticator app | An app such as Google Authenticator generates a new code every 30 seconds. No SMS or internet connection is needed. | Email, cloud and social media accounts |
| Email OTP | The code is sent to the email address on your account. | Password resets, logins from a new device |
| Push approval | Instead of typing a code, you tap "Approve" on a notification in the app. | Mobile banking, Google and Microsoft accounts |
SMS is the most common method because it works on any phone without extra apps. It is also the method with the most delivery problems, since the code has to travel through a mobile carrier. Security standards treat it with some caution too: the US National Institute of Standards and Technology lists SMS and phone-based OTPs as a restricted option in its digital identity guidelines (SP 800-63B), largely because codes sent this way can be phished or redirected.
Why am I getting OTP texts I didn't request?
An OTP text means a platform saw an attempt to use your number. If you started that action, enter the code and continue.
If you didn't, someone may have mistyped their number or may be trying to get into your account. Don't enter the code anywhere and don't share it. If you have an account with that platform, change your password and turn on two-factor authentication. WhatsApp gives the same advice for verification codes received without a request.
Is an OTP the same as 2FA?
No. An OTP is a type of code; two-factor authentication (2FA) is a way of logging in. With 2FA you need two different kinds of proof: something you know (your password) and something you have (your phone or authenticator app). An OTP is the most common way to provide the second one.
- OTP: A single-use, short-lived code. It can be used on its own.
- 2FA: A login method that asks for a second proof on top of your password. That second proof is often an OTP.
- SMS verification: An OTP sent by text message to confirm a phone number. See how the verification flow works for details.
The code you get while signing up for an app is an OTP, but on its own it isn't 2FA, because there's no password involved yet. When you log in to an account with 2FA enabled, you enter your password and then the code; that combination is two-factor authentication.
How to tell if an OTP is still valid
- You requested it and the screen is still waiting for a code.
- The message names the platform you're using.
- It hasn't expired. Most platforms allow a few minutes.
- You haven't requested a newer code since. A new code usually cancels the old one.
Each wrong entry counts as an attempt. After a few failures, the platform may ask you to request a new code or wait before trying again.
If your OTP code isn't arriving
Missing SMS codes are usually caused by a mistyped number, carrier delays or the platform pausing after too many requests. On your own number, start by checking message filters and signal. On a virtual number, the country you pick matters most. Both cases are covered step by step in our guide to missing verification codes.
Receiving a sign-up code without your personal number
If you'd rather not use your own number when signing up for a platform, you can use a one-time phone number. On Onay360 you choose the service and country, get a single-use number and see the OTP in your panel.
This is meant for the sign-up step. Banking, payment apps and government services should send OTPs to your own number. If you do create an account with a temporary number, set up 2FA right away; our guide on keeping your account after the number expires walks through it.