What Is an OTP? One-Time Passwords Explained

An OTP is a one-time password: a short code, usually 4 to 8 digits, that works once and expires within minutes. It proves you hold the phone or email.

How an OTP works

When you sign in or sign up, the app creates a random code, stores it for a few minutes, and sends it to you by text, email, a call or an app notification. You type it back. If it matches and has not expired, the app knows you received it on a phone or inbox you control.

Where you see OTPs

• Sign-up: confirming a new phone number or email.
• Sign-in from a new device: a second step after your password.
• Password reset: proving the account is yours.
• Payments and changes: confirming a purchase or a change to your details.

Kinds of OTP

Keep your OTPs safe

Never share an OTP, even with someone who says they work for the company. A real company never needs you to read a code back to them. If you get a code you did not ask for, someone may be trying to sign in as you: change your password.

OTP vs password

A password stays the same until you change it, so anyone who learns it can use it again and again. An OTP is thrown away after one use and expires on its own, so a stolen OTP is worth very little a few minutes later. That is why many apps ask for both: something you know (the password) and something you have (the phone or inbox that receives the OTP). Together they are called two-step or two-factor sign-in.

FAQ

What does OTP stand for?

One-time password: a code that works for a single sign-in or action.

How long does an OTP last?

Usually between 1 and 10 minutes, depending on the app.

Is it safe to share an OTP?

No. Anyone with the code can act as you for that step.

Related: how long an OTP is valid · authenticator apps · code not received.