How SMS one-time passwords (OTP) work, and why websites use them

What happens behind the scenes

When you enter your number, the site generates a random code and stores it with a short expiry. It sends the code through an SMS gateway to your number. You type the code back in, and the site compares it with what it stored. If it matches and has not expired, you have shown that you can receive messages at that number.

Why phone numbers

Phone numbers are cheap to check and hard to create in bulk, compared with email addresses. Asking for one makes mass-created fake accounts more expensive, and it gives the service a way to reach you for security alerts.

The limits of SMS codes

SMS is convenient but not the strongest option. Messages can be intercepted in rare cases, and criminals can trick carriers into moving a number to another SIM. For important accounts, prefer an authenticator app or a hardware key where the service supports it.

That is also why you should never share an OTP with anyone who asks for it, whatever reason they give. A genuine service will never need you to read the code back to them.

OTP versus two-factor authentication

An OTP is the code itself. Two-factor authentication (2FA) is the practice of asking for something you know, like a password, plus something you have, like a phone that receives a code. SMS is one way to deliver the second factor. Others are authenticator apps that generate codes offline, and hardware keys that prove you hold a physical device.

Ranking the options

• Hardware security key: the strongest option for important accounts.
• Authenticator app: strong and works without signal, recommended for most people.
• SMS code: better than a password alone, but weaker, because texts can be redirected through SIM-swap attacks.
• Email code: depends entirely on the security of the email account.

Why sign-up forms use SMS anyway

For a new account, a service has no authenticator app to rely on. SMS works on every phone, needs no installation, and proves a working number exists. That is why it remains the default for sign-up verification even where stronger options exist for later logins.

Handling OTPs safely

Treat a code like a password that lasts a few minutes. Enter it only on the site or app you just used, never share it, and be suspicious of any request that creates urgency. If a code arrives that you did not ask for, ignore it and consider changing the account's password.