OTP (One-Time Password)
Short answer: An OTP, or one-time password, is a brief code, typically 4 to 8 digits, valid for a single login or transaction before it expires. Apps deliver OTPs by SMS, voice call, email or authenticator app as proof that you control a given phone number or device.
OTPs are the codes typed in right after entering a phone number on WhatsApp, Telegram or a bank site. Since each code works only once, a stolen code becomes useless the moment it is used or expires.
How it works
The service either generates a random code or derives one from a shared secret combined with the current time (TOTP, RFC 6238) or a counter (HOTP, RFC 4226). It stores the expected value, sends the code your way, and accepts it only once inside a short window, often just a few minutes.
SMS and voice OTPs are anchored to a phone number, so that number has to be capable of receiving texts or calls from whichever service is sending it.
OTP varieties and how they're delivered
| Type | How the code is generated or sent |
|---|---|
| TOTP (RFC 6238) | Computed from a shared secret combined with the current time |
| HOTP (RFC 4226) | Computed from a shared secret combined with a counter |
| SMS OTP | Sent as a text to your phone number |
| Voice OTP | Spoken aloud during a call to your phone number |
How it applies to SMS Conecta
Every SMS Conecta number takes unlimited incoming SMS and unlimited incoming calls, with codes showing up in the SMS inbox on your dashboard. Numbers work across WhatsApp, Telegram, Google, Facebook and thousands more apps. When a number gets rejected or codes don't arrive, the 7-day replacement guarantee swaps in a free new number in the same country.
Related terms
- Two-factor authentication (2FA)
- SMS verification
- Non-VoIP number
- Mobile number
Frequently asked questions
How long does an OTP stay valid?
That varies by service, though most expire within a handful of minutes, and every one stops working the moment it is used.
Are SMS OTPs and 2FA the same thing?
An SMS OTP is just one way to deliver the second factor in two-factor authentication; 2FA can equally rely on authenticator apps or security keys.
Can OTPs be received on a SMS Conecta number?
Yes. Incoming SMS has no limit and shows up right in your dashboard inbox, and the 7-day replacement guarantee covers any number an app won't accept.
Related pages
- two-factor authentication
- SMS verification
- non-VoIP numbers
- verification code not received
- real numbers vs free SMS sites
- WhatsApp use case
- Number Porting
- PBX (Private Branch Exchange)
Sources
- IETF: RFC 6238, TOTP: Time-Based One-Time Password Algorithm (as of September 2026)
- IETF: RFC 4226, HOTP: An HMAC-Based One-Time Password Algorithm (as of September 2026)