Why are some SMS OTP codes 4 digits and others 6?

Question

Weirdo · Accepted Answer

Code length is a product security/UX choice; modern guidance usually wants at least six digits. Four digits are easy to type but only 10,000 possibilities; six digits jump to a million, and with rate limiting they better resist online guessing.

There is no worldwide law that SMS one-time passwords must be four or six digits. Banks, shops, and government portals pick their own lengths. Seeing both in the wild reflects different eras, risk levels, and typing comfort—not a carrier rule about code size.

NIST SP 800-63B requires verifier-generated out-of-band secrets to be at least six decimal digits (or equivalent) and to rate-limit failed attempts; issuing a new code must not reset the failure counter. That floor pushed many newer systems to six digits, while older or lower-risk flows may still send four.

Four digits feel like a PIN; six digits match common hardware/software OTP practice (including TOTP truncations). Length alone does not fix SMS risks such as SIM swap or interception, so higher-assurance accounts add authenticator apps or passkeys on top.

Why are some SMS OTP codes 4 digits and others 6?

No universal digit count

Why six digits dominate newer systems

Length is only one control