What is an OTP (one-time password)?
In short
- An OTP is a short code that works once, usually for a few minutes, to prove you’re you.
- It comes by text, email or call, or an authenticator app makes it on your phone.
- Never share an OTP: apps such as Shopee, Careem and Signal say they will never ask for one.
OTP stands for one-time password: a code, usually 4 to 8 digits, that works once and then expires.
Where OTPs come from
- By text (SMS): the most common, sent to the number on your account.
- By email, call or WhatsApp: some apps offer these instead. See codes by WhatsApp.
- From an authenticator app: the app makes a new code every 30 seconds or so, with no message needed.
How long they last
Minutes, not hours. Netflix and eBay give 15 minutes, Autodesk 10. See expired codes.
The one rule
Never share an OTP. Shopee says not to share it with anyone, its own staff included; Careem, Signal and Lyft all say they’ll never ask for one. Anyone who asks is trying to get into your account. See the verification code scam.
OTPs and one-time numbers
A one-time number is a different thing: a phone number that receives an OTP for you. On ReserveSMS, the code shows on screen when the text arrives, within 20 minutes, and the money goes back to your balance if it doesn’t. See what a one-time phone number is.
Common questions
What does OTP mean?
One-time password: a short code that works once, usually for a few minutes, to prove you’re you.
Is an OTP the same as two-factor authentication?
An OTP is often the second step of two-factor authentication, but the term just means the one-use code itself.
Should I ever share an OTP?
No. Apps such as Shopee, Careem and Signal say they will never ask for one; anyone who does is trying to get into your account.