Explainer
What a one-time passcode actually is
A one-time passcode is a short-lived secret proving you control a channel — usually a phone number — at the moment you are asked.
Why they expire
A code's security comes almost entirely from its short life. Six digits is only a million combinations, which is trivial to guess given time; a five-minute window plus a few attempts is what makes that impractical.
What SMS OTP protects against
It raises the cost of mass account creation and blocks attackers who have a password but not the phone. That is genuinely useful, and it is the reason verification exists at all.
What it does not protect against
SMS is not an encrypted channel, and SIM-swap attacks target the number itself. For high-value accounts an authenticator app or hardware key is meaningfully stronger — SMS is the floor, not the ceiling.
