I have been asked to research expiry times of text messages sent to a user that contain a login code.

In this journey a user will identify themselves on a website and then ask for a text message to be sent to their phone which contains a temporary pass code. They will enter this passcode into the website and be logged in.

My question: how long should this text code remain valid before it expires?

5 min? 20 min? any guidance?

  • 3
    Best UX is "valid forever" but with also "perfect security". Unfortunately something has to give as that's not feasible with current technology. Understandably answers below are divergent. It could be helpful to specify your goals and constraints better.
    – Jason A.
    Dec 13, 2017 at 13:50

3 Answers 3


The most common time frames are between 5 and 10 minutes. Depending on what your code is for, you can change the expiration times. For example, verification codes tend to be active longer (Google uses 30 days) than a login code. I think a good guideline is, the more sensitive the service is, the shorter the code should be valid.

You need to give users enough time to actually input the code, but not enough time that generated codes are invalid because the system expects a different one. As far as I'm aware, multiple codes are usually simultaneously valid for a period of time because it's too difficult to correctly anticipate user speed behaviour.

If you find there is frustration regarding codes because users wait too long between generating and actually using the code, you can nudge them into action by displaying a timer next to the code. This tends to motivate people because they now feel there is a 'deadline' of sorts they have to adhere to.

Google adds an expiration timer to their codes Google adds a timer to their Google Authenticator app codes.


This would be a good question for data security board.

The expiry time of the authentication code should depend entirely on currently required level of security and should vary from user to user individually. The time periods will also depend on the security level. If you set security levels as 1, 2, 4, 8, 10 etc., you can divide my example numbers by the level of security.


level 1 - 20 min - Working as usual, no threats detected. Requesting new code allowed.

level 2 - 10 min - Threats detected, potential breach. Requesting new code allowed upon old code expiry.

level 4 - 5 min - Potential brute force attack. Requesting new code allowed upon old code expiry time + additional wait time required (ex. additional 5 mins).

level 8 - 2.5 min - Brute force attack confirmed. User is unable to request new code until attack is no longer taking place.

level 10 - 0 min - Account is blocked, additional assistance required.

Bear in mind, this is just an example draft and should be re-designed is ever used for an actual system.

As an example of a similar approach you can research http://store.steampowered.com/ authentication system.


All access codes are single-used codes. The most important issue is that these codes should not be valid after use. Two algorithms can be used: HOTP and TOTP. HOTP (HMAC-based one-time password) means that generated password is valid until it has not been used. TOTP (time-based one-time password) means that generated password is temporary and expires in some period of time. Use of all other algorithms is considered to be unreliable as the next OTP can be predicted based on the previous ones.

The expiry time of OTP should be:

  • as short as possible;
  • convenient for the user (enough to check the SMS and enter the OTP).

For example, for hardware or software tokens 30 or 60 seconds expiry time is usually used.

Also, you should remember that it will take some time to deliver the SMS to the user and this time has to be taken into account.

So, the expiry time of OTP sent to a user depends on a lot of factors and should be found out in a practical way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.