Verification Code SMS Templates (OTP & 2FA)

Templates for one-time passcodes, sign-up confirmations and security alerts. Each is short enough for a single SMS and written to discourage code-sharing scams.

Best practices for OTP text messages

• Name your app or company so the user knows who sent the code.
• Say “do not share”. Phishing scams often ask victims to read out their code.
• State how long the code is valid (5–10 minutes is common) and generate codes with a cryptographically secure random generator.
• Do not put links in OTP messages: users learn to trust links in codes, which scammers exploit.
• Keep it in GSM-7 (no emoji or curly apostrophes) so it fits in one segment: check with the SMS character counter.

Autofill: the “@domain #code” line

Safari on iPhone/Mac and Chrome on Android support origin-bound one-time codes. If the last line of the SMS is @example.com #482913 (your site's domain, a space, then # and the code), the browser offers to fill the code only on that website. That makes autofill easier for users and helps block phishing sites. On your sign-in form, add autocomplete="one-time-code" to the code field.

Login & sign-up codes

Security alerts