Balance one-time-passcode length, validity window and attempt limits against the odds an attacker guesses the code.
A numeric OTP has almost no entropy — six digits is 19.93 bits, which an offline attacker would exhaust instantly. Its security comes entirely from the attempt limit and the validity window, so the guess probability is a binomial over a handful of tries against a million codes. Lengthening the code buys 3.32 bits per digit; tightening the attempt limit is usually the cheaper control. Without an attempt cap a six-digit code is trivially brute-forced in bulk, which is exactly how several high-profile SMS-verification bypasses worked; the maths shows how thin the margin is.
OTP Lifetime
P(guess) = 1 − (1 − 1 ÷ 10^digits)^attempts, where attempts is the lower of the per-code limit and the rate limit over the validity window.
Break-even attempt count
attempts for a 50 % chance = ln(0.5) ÷ ln(1 − 1 ÷ 10^digits).
P(guess) = 1 − (1 − 1 ÷ 10^digits)^attempts, where attempts is the lower of the per-code limit and the rate limit over the validity window. A numeric OTP has almost no entropy — six digits is 19.93 bits, which an offline attacker would exhaust instantly. Its security comes entirely from the attempt limit and the validity window, so the guess probability is a binomial over a handful of tries against a million codes. Lengthening the code buys 3.32 bits per digit; tightening the attempt limit is usually the cheaper control.
Without an attempt cap a six-digit code is trivially brute-forced in bulk, which is exactly how several high-profile SMS-verification bypasses worked; the maths shows how thin the margin is.
This calculator takes 4 inputs: Passcode length, Validity window, Attempts allowed per code, Rate limit. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
NIST SP 800-63B allows a maximum of 10 minutes for an out-of-band secret and 2 minutes is common practice for SMS. A longer window does not weaken the code directly, but it widens the interval in which a phished code can be replayed and gives a rate-limited attacker more attempts.
Yes, with throttling: three attempts against a million codes is a 0.0003 % chance. Without throttling the same code falls to a few hundred thousand automated attempts. The attempt limit, not the digit count, is the control that matters.