> For the complete documentation index, see [llms.txt](https://getverifycode.gitbook.io/getverifycode-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://getverifycode.gitbook.io/getverifycode-docs/how-sms-verification-works.md). # How SMS Verification Works *By Alex Carter, Editor at GetVerifyCode* SMS verification is a check that you can receive a text at the phone number you entered. The service sends a short one-time code, usually 4 to 8 digits, and you type it back within a few minutes. If the code matches and hasn't expired, the number is marked verified. ## Key facts * The code is a one-time passcode (OTP). It works once and expires, often within 5 to 10 minutes. * It shows that you control a phone number. It doesn't prove who you are. * Codes can come from a regular long number, an alphanumeric sender name, or a 5 to 6 digit short code. * Many security bodies treat SMS as a weaker factor than authenticator apps or passkeys, so it's often used for sign-up and recovery rather than high-risk actions. ## Step 1: You enter a phone number The app normalizes it to international (E.164) format, for example +44 7700 900123, and checks whether it can deliver to that country and number type. Some apps refuse certain number ranges. That's why you may see "this phone number can't be used for verification". ## Step 2: The app generates a code The server creates a random code, stores a hashed copy with an expiry time, and links it to your session. Good implementations also limit how many codes a number can request per hour. ## Step 3: An SMS provider sends the text The app passes the message to an SMS gateway, which routes it through carriers to the destination network. Delivery usually takes seconds. But carrier filtering, sender-ID rules in some countries, roaming and congestion can delay it or block it. ## Step 4: You receive and enter the code Your phone, or an online inbox if you're using a virtual number, shows the message. You type the code. Many phones offer to autofill it. ## Step 5: The server validates it It checks that the code matches, hasn't expired, hasn't been used, and that you're within the attempt limit. Requesting a new code normally cancels the old one, which is a common reason for "invalid code" errors. ## Why codes fail to arrive * Wrong country code or a typo in the number. * Weak signal, roaming, or a full SMS inbox. * Carrier spam filtering or blocked short codes. * Too many resend requests, which triggers a temporary rate limit. * The app doesn't deliver to that number type or region. A full troubleshooting list is in [Didn't Get the Verification Code? 12 Fixes](https://getverifycode.com/blog/didnt-receive-verification-code-sms-fixes). ## Using a temporary number to receive a code Some people would rather not hand their personal number to every sign-up form. A temporary virtual number lets you receive a code online for a single verification. With [GetVerifyCode](https://getverifycode.com/), you pick the service and country, reserve a number for about 20 minutes, and read the SMS in your inbox. If no SMS arrives, the held amount returns to your wallet. Top up your wallet from $1. Each number is priced live per service and country. Keep the trade-offs in mind. A temporary number may not work for account recovery later, and some platforms don't accept virtual numbers at all. For accounts you plan to keep long-term, use a number you'll still control. Whether temporary numbers are allowed depends on each platform's terms and your local law. See [Are Temporary Phone Numbers Legal and Allowed?](https://getverifycode.com/blog/are-temporary-phone-numbers-legal). ## For developers If you build OTP flows, test them with real inbound SMS across countries before launch: expiry, resend cooldowns, rate limits and logging hygiene. Keep codes out of your logs. A practical checklist is maintained at [getverifycode.github.io](https://getverifycode.github.io/) and in the [otp-sms-testing-checklist](https://github.com/GetVerifyCode/otp-sms-testing-checklist) repository. ## FAQ ### Is an SMS code the same as a verification code? Yes. "SMS code", "OTP" and "verification code" usually mean the same thing: a one-time code sent by text. ### How long is a verification code valid? It depends on the app, typically a few minutes. Request a new one if it has expired. ### Is SMS verification secure? It's better than no check, but it can be intercepted or redirected (for example through SIM swaps). Use an authenticator app or passkey where one is offered. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://getverifycode.gitbook.io/getverifycode-docs/how-sms-verification-works.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.