# One-Time Code SMS: Best Practices | ZafeConnect

> How to write and send one-time code messages that people use and attackers cannot exploit: wording, length, expiry, resend limits and the auto-fill format.

Canonical URL: https://www.zafeconnect.com/blog/one-time-code-sms-best-practices
Language: en
Last modified: 2026-11-09

## One-time code messages that work

URL: https://www.zafeconnect.com/blog/one-time-code-sms-best-practices

Published: 2026-11-09

A one-time code has one job: get a person into their account in a few seconds. The wording, the timing and the limits around it decide whether it does.

Key takeaways:
- Put the code first or near the start, name the sender and say how long the code is valid.
- Keep the message to a single segment and avoid links.
- Limit how often codes can be requested and how many wrong tries are allowed.
- Use the origin-bound format so browsers and phones can fill the code in safely.

### What a good message contains
An example: “ExampleCo code: 482915. Valid for 10 minutes. Never share this code.” It is short, specific and fits in one message.
- The code, early in the text, in digits only
- Your brand or service name, so the person knows why it arrived
- The validity period, for example ten minutes
- A short line telling the person not to share the code with anyone
- No marketing, no extra links and no long explanations

### Make it fill in by itself
Phones and browsers can offer to fill in a code from a text message. Browsers that support the Web OTP API look for a final line in the origin-bound format: an at sign, your domain, a space, a hash sign and the code. For example: @example.com #482915.

This also helps against phishing, because the code is offered only to the domain named in the message. Use it where your sign-in page supports it.

### Limits that protect you and your users

- A short validity period and single use
- A cap on how many codes can be requested per number, per account and per device in a given time
- A cap on wrong attempts before the code is cancelled
- A pause before a new code can be requested, with a clear message on the screen
- Monitoring of requests per country and per number range, to catch abuse early

### Speed matters more than for any other message
A code that arrives after the person has given up costs you a sign-up and a second message. Measure the time from request to delivery on your own traffic, by country and operator, and set a fallback: after a short wait, offer another way, such as a call or another channel.

### How ZafeConnect fits
ZafeConnect carries one-time codes as A2P SMS over 190+ countries, with intelligent routing and fallback, delivery reports from the operators and local SenderID support. Reported delivery of over 98% is not a guarantee, so keep your own fallback and monitoring in place.

FAQ:
Q: How long should a one-time code be valid?
A: Short, usually a few minutes up to ten, and single use. Choose the shortest period your users can manage.

Q: Should the code be in a link?
A: No. Send the code as text. Links in code messages are harder to trust and may be filtered.

Q: How many digits should a code have?
A: Six digits is common. Combine it with limits on attempts, because the length alone does not protect against guessing.