One-time password
A single-use code sent by SMS to check who controls a phone number, with a short expiry and attempt limits.
Definitions only — a term explained here is not a service we sell.
A one-time password (OTP) is a code that works once and expires within minutes. It proves control of the number now, not identity, so the limits around it carry the security.
Expiry, attempt count, resend policy and number validation matter more than the code itself.
Delivery and failure
The application generates a random code, hashes it with an expiry and sends the plain code by A2P SMS through a message center or aggregator. Security comes from the application logic, not the SMS transport. A code can arrive late, reach a wrong number or follow a SIM swap; the OTP SMS delivery page covers the path.
Where the code travels
- Application
- SMPP gateway
- SMSC
- HLR / HSS
- MSC / MME
- Handset
- Delivery receipt
Text description
The application submits to an SMPP gateway, which passes the message to the SMSC. The path then runs through the HLR/HSS and MSC/MME to the handset, and a delivery receipt is the final node.
What to check
Rate-limit by number, IP and device, cap attempts and set a short expiry. Decide the fallback before launch: a voice call, an authenticator app or a manual review.