I'm designing a screen for OTP verification. The design looks similar to this. Taken from here

enter image description here

My questions are,

  1. Should I auto-verify the OTP when the user has entered all the 6 digits or Should I expect the user to press the Validate button? What will be the better and consistent user-experience?

  2. If I auto-verify the OTP once the user is done with entering the 6 digits, Are there any security concerns? (Assuming, I'm limiting the number of validation attempts on the backend.)


Keep language consistent: make sure the action is the same as the button. Change 'Validate' to 'Verify'as the system says ""...to verify your account"

Aside from that I see nothing wrong with automatically proceeding the user if a correct verification code has been entered as it saves the user a click.

My bank does this when I enter a verification code to set up a new payment.

But with that scenario, what would the system do if a wrong code was entered? It would have to feedback to the user somehow or other; you need to consider that interaction too.

Either way, test with users whatever you build.

Edit: and remove the button if auto verify; you don't need it

  • Thanks for your suggestions. For the case when an incorrect was entered, I'm displaying a proper error message and a red underline is added to each input. I hope this is enough. This is for the mobile users. What do you think? – Hardik Modha Oct 9 '18 at 4:42
  • 'a red underline is added to each input' - can you elaborate? – colmcq Oct 9 '18 at 9:11
  • 1
    Why Verify instead Validate? You should explain the suggestions. – Gabriel Anderson Oct 10 '18 at 1:49
  • 1
    to keep the language consistent "...to verify your account" Fairly obvious and basic UX. But I should have explained that. Will edit answer. – colmcq Oct 10 '18 at 8:51

If I see a large Validate button, I'll assume that's what I have to click. If instead, the form auto-submits, that will break my expectations and make me feel like this application is unpredictable.

It's not wrong to auto-submit the code, but make it obvious that there's not something that I have to do after typing in order for this to submit.

I'd recommend you ask the folks at Information Security about any security concerns you may have during this design process. They're much better equipped to adequately address these concerns.

  • So, Should I consider removing the Validate button if I'm auto-submitting the form? – Hardik Modha Oct 9 '18 at 4:39
  • - yes, you don't need it. But the system needs to tell the user to enter a code and that it is automatically verified – colmcq Oct 9 '18 at 9:16
  • Yes, I'd do away with the button if the user will never have a chance to click it. – maxathousand Oct 9 '18 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.