How to use the otp generator
- Set the number of digits for your one-time password, from 4 to 10.
- Choose how many codes you need (up to 100).
- Check No repeats if every code must be unique.
- Click Generate to produce your numeric OTP list.
How the randomness works
This otp generator uses crypto.getRandomValues(), which draws entropy from the operating system's cryptographic random number generator rather than relying on a predictable mathematical formula like Math.random(). For each digit position, a random byte is requested. Bytes 250 to 255 are thrown away and the rest are reduced modulo 10, so each digit from 0 to 9 is exactly equally likely. Reducing all 256 byte values modulo 10 would make the digits 0 to 5 slightly more common than 6 to 9.
A 6-digit numeric code has 1,000,000 possible combinations (from 000000 to 999999). An 8-digit code has 100,000,000 combinations. The more digits you choose, the harder it is for an attacker to guess the correct value by brute force.
Choosing the right length
The ideal length for a verification code depends on how it is delivered and how long it remains valid. Here is a reference table of common lengths and their total possible combinations:
| Digits | Combinations | Typical use case |
|---|---|---|
| 4 | 10,000 | Short-lived app prompts, local device pairing |
| 5 | 100,000 | Email verification links with short expiry |
| 6 | 1,000,000 | SMS authentication, banking apps |
| 8 | 100,000,000 | High-security account recovery, backup codes |
| 10 | 10,000,000,000 | System tokens, automated API handshakes |
Six digits is the most common standard for SMS-based two-factor authentication because it balances memorability with security. Four digits are acceptable only when the code expires within seconds or the attempt rate is strictly limited.
Why use the no-repeat option
When generating multiple codes at once, there is a small chance that two identical codes will appear purely by coincidence. This is an application of the birthday problem in probability theory. For example, if you generate 100 random 4-digit codes, the pool only contains 10,000 possibilities, which gives roughly a 39 percent chance that at least two of them match.
Checking the No repeats box forces the generator to verify each new code against those already produced. If a duplicate occurs, it is discarded and a new one is drawn. A batch is limited to 100 codes, far below the 10,000 combinations of the shortest 4-digit setting, so a unique batch can always be completed.
Numeric OTPs versus alphanumeric passcodes
Numeric one-time passwords are designed for human entry. A user receiving an SMS or reading a screen can type six digits quickly without worrying about uppercase letters, lowercase letters, or ambiguous characters like O and 0. If you need longer, machine-readable secrets for APIs or bearer tokens, consider using the API key generator or password generator instead, as they include alphabetic and special characters for higher entropy per character.
For time-based or counter-based authentication protocols, tools like the TOTP secret generator or HOTP generator handle the shared-secret setup required by authenticator apps.
Security considerations for developers
Generating the code is only one part of a secure verification flow. When implementing an otp generator in a production system, keep these rules in mind:
- Rate limiting: Restrict the number of failed attempts. Without rate limiting, an attacker can try all 1,000,000 combinations of a 6-digit code rapidly.
- Short expiry: Codes should expire after 5 to 10 minutes. Once expired, the code must be rejected even if guessed correctly.
- Single use: Invalidate the code immediately after one successful verification.
- Secure transport: Send codes over encrypted channels (TLS for web, secure SMS gateways) to prevent interception.
- Server-side validation: Never validate the code on the client side. The server must compare the submitted code against the stored hash or value.
Worked examples
| Example | Input | Result |
|---|---|---|
| Single 6-digit code | Digits: 6; How many: 1; No repeats: no | 327447 |
| Five 4-digit codes | Digits: 4; How many: 5; No repeats: no | 1879, 2046, 2236, 2491, 6244 |
| Ten unique 8-digit codes | Digits: 8; How many: 10; No repeats: yes | 23443247, 83013519, 65738823, 97552822, 81852158, 13336133, 47569842, 28452240, 48709819, 16945369 |
| Three 10-digit codes | Digits: 10; How many: 3; No repeats: no | 3863304305, 5782361775, 7153893088 |
FAQ
Is this otp generator secure?
Yes. It uses the Web Crypto API provided by your browser, which relies on the operating system's cryptographically secure pseudorandom number generator. No data is sent to any server.
What is the maximum number of digits I can generate?
You can generate numeric codes up to 10 digits long. Ten digits provides 10 billion possible combinations, which is sufficient for high-security temporary tokens.
Can I generate more unique 4-digit codes than exist?
No. There are exactly 10,000 possible 4-digit combinations (0000 to 9999), and this tool limits a batch to 100 codes, so the no-repeat option can always be satisfied. A request for more than 100 codes shows an error.
Why would I use a numeric OTP instead of a password?
Numeric one-time passwords are easier for users to read and type quickly from a phone screen or SMS message. They are intended for temporary verification, not long-term access.
Does the no-repeat option reduce security?
No. Removing duplicates slightly reduces the total pool of available codes, but the impact is negligible unless you are generating a very large batch relative to the total possible combinations.
Are leading zeros included in the codes?
Yes. Every digit position is chosen independently from 0 to 9, so a 6-digit code might be 004821. Leading zeros are preserved to maintain the exact length.