I need to send one-time codes with a relatively short expiration time (say 15 minutes). Potentially there may be hundreds of codes active at the same time.

What are suggested formats for this?

Any quick pointers to where I could learn about the necessary entropy/length for the code?

  • 2
    I think you'd have better luck over at security.stackexchange.com. The security is going to matter much more than the UX of how hard it is to type. The UX answer will simply be "the shortest and least complex as possible while still meeting your minimum security needs".
    – DasBeasto
    Jan 23, 2017 at 17:32
  • xkcd.com/936
    – Alvaro
    Jan 23, 2017 at 20:06

3 Answers 3


Generally, chunks of 3 to 4 numbers is optimal. See phone numbers and credit cards. You could do 2x4 digit chunks, 3x3 digit chunks, etc.


I would stick to 5 characters. Most people can easily retain 5 characters in their heads and it wouldn't be a chore. 5 characters also give you flexibility in the amount of tokens that can be issued. If you are nervous about running out of tokens then I would do 3 Numeric and 2 Alphabetic characters.

With 5 Numeric characters you can issue at most 10!10!10!10!10! tokens. With 3 numbers and 2 letters you get 10!10!10!26!26!. (7.7718991*10^72 possible combinations)

Again, I would say the most secure token is one that is very hard to brute force and with option 2 you hit a compromise between long/random token and the person not typing a sentence to log in.

  • Like the advice about having part alphanumerics. Your math is off, however, since according to your calculations a single numeric character would give 3 million combinations. You need to use number_of_values_per_position to the power of number_of_positions.
    – gzost
    Jan 24, 2017 at 16:10

@DasBeasto has a point regarding security, though as far as the UX goes I've always been of the mindset that most people today can't retain more than 3 digits in their head these days. Any more and they start making mistakes or forgetting. That said, a few apps do use 3-digit lengths, numerals only, to either unlock or gain access to a particular application. And frankly that's fine, especially for two-factor authentication where your phone is the second factor.

That said, many apps and services prefer to use different counts. 4, 6, 10, alphanumeric, etc. Really it runs the gamut, and while each additional character and type of character adds to the security, it detracts from the UX and also isn't always necessary depending on how the app is built. For instance, the last app I built that used this (where we sent an SMS with a 3-digit code) had a push notification that went out in advance, once the request was sent, with the correct code (so that no one else could use it without having access to the phone).

Ultimately it depends on the specific use case (which isn't listed here), but in general three digits is safe and easy for users to remember.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.