What's the optimal number of digits for a verification text message?

Question

This is regarding a validation process in an app. User has downloaded the app, within it they get asked to validate their account through a text message. So they have to check their messages, then enter a code in the app.

When you get a text message sent to the phone number you've already entered to validate your account, I know iCloud uses 4 digits and some uses 6. In my mind 4 is better since it's easier to remember as a chunk than 6 digits. I can easily remember 4432 but harder to remember 443 267 as I jump between the messaging app and the app that validates. I get there's a security issue, but since they've entered the number themselves and received the text the security should be high even with 4 digits.

So, here's the question: which will result in more conversion and does anyone have any articles regarding this?

Answer 1

As is common when dealing with user experience and security, this is a balancing act.

For the user experience side of it, I'd recommend you read at least the introduction of the Short-term memory article on Wikipedia. Particularly the part that mentions the average capacity is 3-5 items. The upper end of that range might be a sufficient length while still enabling the user to retain it in their short-term memory.

I wouldn't overthink it though—I don't think your conversion should be affected much. It seems unlikely that 2 additional digits in your verification text will cause a significant number of users to abandon everything, and if it does, they likely had additional reasons (i.e. 2 digits is not a likely dealbreaker).

However, the folks at Information Security surely have already provided their recommendations on the security implications at play, and you should seek those out before making your decision.

Answer 2

Most 2FA/MFA apps (Microsoft and Google ones) use 6.

I'm imagining this is because people remember 7 items (+/- 2 https://lawsofux.com/millers-law.html) best.

Six is the same as a phone number which again most people can remember, but on both the apps I mentioned the numbers are split into two sets of three digits.

For convenience, both MS and Google 2FA apps also offer a copy / paste and some mobile apps I've seen seem to be able to read your SMS as it arrives and auto populate fields so this is a consideration.