A one time code

Session and account

A one time code is a short run of digits that is the correct answer only during the interval in which it was computed.

The shape

This is the simplest shape documented anywhere on this site. It is digits, and there is a fixed number of them. Everything that goes wrong with it goes wrong because something treated those digits as a number rather than as a string.

The width is not a preference and does not vary from code to code within one system. Where six digits are used, every code is six digits, including the ones that begin with a zero, and the ones that begin with two zeros. Where eight are used, the same holds at the wider size. A code you receive that is a different width from the last one did not shrink; something reformatted it in transit.

Width

six digits in the usual case, eight in the less usual one. The width is fixed for a given system and does not vary between codes

Alphabet

the digits zero to nine and nothing else. No letters, no punctuation, no sign

Grouping

often displayed with a gap in the middle so it can be read aloud. The gap is a display device and is not part of the value

Leading zeros

significant. A code beginning with zero is six characters long like any other and the zero counts

Separator

none in the value itself, ever

Lifetime

a fixed interval, commonly short, measured from a shared origin rather than from when you looked

six digits, counting up as a placeholder
012345

the same value shown with a reading gap
012 345

the eight digit variant
01234567

the classic loss: five digits where six were sent
12345

Where the digits come from

A code of this kind is not looked up in a table. It is calculated, and one of the inputs to the calculation is the current time, rounded down to an interval. Both sides run the same calculation independently and compare the results.

That single fact explains the behaviour that confuses people most. The code is not sent to you and then remembered; it is derived. It is not revoked when it stops working; it simply stops being the answer, because the input changed. And a code that was correct thirty seconds ago is not stale in the sense of an expired ticket. It is arithmetic that no longer matches.

It also explains why the two clocks matter more than anything else. If the far side thinks it is a different minute than your side does, both sides compute honestly and disagree, and the digits give no hint that this is what happened.

012345      six characters, first one is a zero

12345       five characters, the zero was dropped

The value passed through something that treated it as a number, and a number has no leading zero to keep. Spreadsheets, form fields typed as numeric and casual retyping all do this.

How to check it by eye

What a wrong shape means

Wrong shapes here are narrow and easy to name. Too few characters, which is nearly always a lost leading zero. Too many, which is nearly always a code from a system with a different width, or two codes run together. A letter in the run, which means the value is not this shape at all and you are looking at something else.

Every one of those describes the path the value took to reach you. A code that arrived through a spreadsheet cell, a numeric input box or a person reading it out is a code that passed through a numeric interpretation, and numeric interpretations discard leading zeros. That is a property of arithmetic, not evidence of interference.

The failure that produces no wrong shape at all is the important one. A perfectly formed six digit code that is rejected has almost certainly gone out of interval, or the two clocks involved disagree. Nothing you can see in the digits distinguishes those.

What a correct shape does not prove

The whole difficulty with this shape is that correctness of format and correctness of value are unrelated. Six digits are six digits whether or not they are the six digits that will be accepted.

• Not that the code is current. Interval membership is invisible in the characters and is the only thing that decides acceptance.
• Not that it was computed for the account you are thinking of. Any system using this shape produces values indistinguishable from any other.
• Not that it has not been used. A one time code that has been spent looks exactly like one that has not.
• Not that your clock and the far side agree. Two honest calculations from clocks that differ produce two different correct answers.
• Not that the width you are looking at is the width expected. Six and eight digit systems both exist and neither announces itself.

What this card is not

How codes are generated, what is shared to make the calculation possible, and how any particular system enrols a device are all outside a format reference and are not covered here. The readable form of the clock these codes depend on is documented at a timestamp printed on a page, and its machine form at a time written as a plain integer.

Questions people send about this shape

Does the space in the middle need to be typed?

No. The gap is added when the code is displayed so a person can read it in two halves rather than as one run of six. The value itself has no separator and never has one, so typing the space usually produces a rejection or is stripped silently, depending on the form. If you are unsure, the safe reading is that the value is only the digits.

Why did a code fail immediately after appearing?

The likeliest reasons are that the interval turned over between reading and typing, or that the two clocks involved disagree by more than the system tolerates. Both produce identical symptoms and neither leaves a mark on the digits. This site does not test anything and cannot tell you which applies in any particular case.