Receive OTP codes online

A one-time password is a short secret a service generates for a single use and then throws away. Two properties define it: it works once, and it stops working shortly after it is issued.

It arrives by one of several channels, and they are not equivalent. SMS is the most widely supported and the one these numbers serve. Authenticator apps generate the code on your device from a shared secret, with no network in the path. Email is common as a fallback. Voice reads the digits aloud down a call. Only the first has anything to do with a phone number you can rent.

The order of operations is the whole trick:

1. Order the number first. Pick the service you need the code for and let the number be issued before you touch the signup form.
2. Submit it on the site. Paste the number into the field asking for one and press send.
3. Watch the order. The message appears as the carrier delivers it — there is nothing to refresh and no inbox to sync.
4. Use it immediately. The code is already partway through its own expiry by the time you read it.

The common mistake is doing one and two in the other order: requesting the OTP, then going off to buy a number. The service started its timer when you pressed send, and you are now spending that window on checkout.

There are always two countdowns running and neither one is shown to you in full.

The service's clock starts when you request the code and typically runs for a handful of minutes. The number's clock starts when the order is created and is shown on the order. A code that arrives inside the second window but outside the first is delivered, visible, and already useless — which is why "the code arrived but it says invalid" is such a common ending.

Practically: do not request the OTP until the number is in front of you, and do not queue up several requests hoping one lands. Repeat requests usually invalidate the earlier codes and can trip a rate limit that stops the service sending at all for a while.

Work through it in this order, because each step rules something out:

• Check the order rather than the signup form. The message shows on the order as soon as the carrier hands it over; the form has no idea.
• If the number expired empty, cancel it. The charge comes back when nothing was delivered.
• Request once more on a fresh number, and submit it on the site immediately.
• If a second number also gets nothing, the service is refusing the number rather than losing the message — a different service, or a different approach to that account, is the only thing that changes the outcome.

What does not help is retrying on the same number. If a message was never sent, no amount of waiting produces one. SMS verification walks through the delivery path itself and the places a code is lost along it.

An OTP is a credential. Three rules follow from that, and the third is a condition of using this service:

• Nobody legitimate will ever ask you to read one out. Not support, not a courier, not a bank. A request for your code is the attack itself.
• Do not type a code you did not request. An unexpected OTP means somebody has your password and is standing at the second door.
• Only receive codes for accounts you are entitled to. Rent a number to verify an account you are creating or that is yours. Receiving an OTP that belongs to someone else's account is fraud, and that is not what these numbers are sold for.

SMS is the most compatible second factor and the weakest one in common use. A number can be ported away from its owner, and a rented number is by definition not permanently yours. For anything holding money or identity, an authenticator app or a hardware key is a materially better second factor, and most services that offer SMS also offer one of those.

That is a straight recommendation against the grain of what is sold here: a rented number is the right tool for a one-off verification, and the wrong tool for the permanent second factor on an account you care about.