Work out otp entropy instantly with clear inputs, formula shown and shareable results.
A six-digit OTP has only a million values and about 19.9 bits of entropy, which is weak by cryptographic standards. Its security comes almost entirely from rate limiting: with three attempts per 30-second window, the chance of a hit is 3 in a million per window, and NIST SP 800-63B requires exactly this kind of throttling for exactly this reason.
OTP guessing
code space = 10^digits; entropy = digits x log2(10); P(success per window) = attempts / code space
Eight digits raises entropy to about 26.6 bits and is supported by TOTP, but rate limiting delivers far more protection per unit of user friction.
SP 800-63B mandates throttling of failed authentication attempts, commonly capped at around 100 consecutive failures before the account is locked or rate limited.