This is regarding a validation process in an app. User has downloaded the app, within it they get asked to validate their account through a text message. So they have to check their messages, then enter a code in the app.

When you get a text message sent to the phone number you've already entered to validate your account, I know iCloud uses 4 digits and some uses 6. In my mind 4 is better since it's easier to remember as a chunk than 6 digits. I can easily remember 4432 but harder to remember 443 267 as I jump between the messaging app and the app that validates. I get there's a security issue, but since they've entered the number themselves and received the text the security should be high even with 4 digits.

So, here's the question: which will result in more conversion and does anyone have any articles regarding this?

2 Answers 2


As is common when dealing with user experience and security, this is a balancing act.

For the user experience side of it, I'd recommend you read at least the introduction of the Short-term memory article on Wikipedia. Particularly the part that mentions the average capacity is 3-5 items. The upper end of that range might be a sufficient length while still enabling the user to retain it in their short-term memory.

I wouldn't overthink it though—I don't think your conversion should be affected much. It seems unlikely that 2 additional digits in your verification text will cause a significant number of users to abandon everything, and if it does, they likely had additional reasons (i.e. 2 digits is not a likely dealbreaker).

However, the folks at Information Security surely have already provided their recommendations on the security implications at play, and you should seek those out before making your decision.

  • +1 pretty much how I would have answered the question, but you beat me to it :D
    – Michael Lai
    Mar 31, 2020 at 23:07

Most 2FA/MFA apps (Microsoft and Google ones) use 6.

I'm imagining this is because people remember 7 items (+/- 2 https://lawsofux.com/millers-law.html) best.

Six is the same as a phone number which again most people can remember, but on both the apps I mentioned the numbers are split into two sets of three digits.

For convenience, both MS and Google 2FA apps also offer a copy / paste and some mobile apps I've seen seem to be able to read your SMS as it arrives and auto populate fields so this is a consideration.

  • +1 good point but the 7+/-2 rule is a little bit less straight forward than that...
    – Michael Lai
    Mar 31, 2020 at 23:08
  • 1
    You shouldn't use phone number as generalized rule for how many digits people can remember. For example my phone number has 10 digits but I remember it very well through the repeated use. Apr 1, 2020 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.