OTP Message Generator for SMS and WhatsApp

What a good OTP SMS template contains

A verification message has one job: get the right code to the right person quickly, in a way that is hard to abuse. Most users read the code from the lock-screen notification, which shows only the first line or so. Put the code at or near the start, and make the brand clear so the user knows which service sent it.

Length matters for cost and reliability. A GSM-7 SMS holds 160 characters. Once a message is split, each part holds 153. A single character outside the GSM-7 alphabet, such as an Arabic letter, an emoji, a curly apostrophe or an accented letter like "ó" or "ç", switches the whole message to UCS-2. That drops the limit to 70 characters, or 67 per part. A two-part OTP costs twice as much and has a slightly higher chance that one part arrives late. The generator shows the encoding and segment count for every variant and can swap accented letters for plain ones so Spanish, Portuguese and French messages stay in GSM-7.

• Code first or early: "482913 is your Acme code" shows in the notification preview.
• Brand name: tells users which service sent the code, and that makes phishing harder.
• Expiry: "It expires in 5 minutes" sets an expectation and limits misuse.
• Warning: "Do not share this code with anyone, including our staff."
• No links: carriers often filter OTPs that contain URLs, and links train users to tap on phishing.

Android autofill: the SMS Retriever format

Google's SMS Retriever API lets an Android app read the verification SMS without the SMS permission and without the user typing anything. According to Google's documentation, the message must be no longer than 140 bytes, must contain the one-time code, and must include an 11-character hash string that identifies your app. That 140-byte limit equals 160 GSM-7 characters or 70 UCS-2 characters, so in practice the message has to fit in a single SMS.

The hash is the first 11 characters of a base64-encoded SHA-256 hash of your package name and signing certificate. Google's own example puts it on its own line at the end: "Your ExampleApp code is: 123ABC78", a blank line, then "FA+9qCX9VSu". Compute the hash from your production keystore and hard-code it on the server. Google says not to use hash strings computed dynamically on the client. Older versions of the documentation required the message to start with "<#>". The current page does not list that prefix. It does no harm, but it uses 4 characters. If you cannot control the message format, the SMS User Consent API is the alternative: the user taps once to let your app read that single message.

iPhone and web autofill: domain-bound codes

iOS and macOS detect codes in incoming SMS and suggest them above the keyboard when the field is marked as a one-time code field: textContentType = .oneTimeCode in a native app, or autocomplete="one-time-code" on an HTML input, as described in Apple's developer documentation. Since iOS 14 and macOS Big Sur, Safari also supports origin-bound one-time codes, a format defined in the WICG "Origin-bound one-time codes delivered via SMS" specification.

In that format the last line of the message is "@example.com #747723": the domain with an @ in front, then exactly one space, then the code with a # in front. An optional third value, "@embedded.example", names an embedded site. Human-readable text can come before the last line. Any other text between the values makes the line invalid. AutoFill then offers the code only on that domain or in apps associated with it, which makes it much harder to phish. The generator builds a combined message that carries the Android hash and the domain-bound last line and, for Latin-script languages, still fits in 140 bytes. In Arabic, send the Android and iOS formats separately.

WhatsApp authentication templates: what you can and cannot change

WhatsApp requires an authentication template to send one-time passwords, and Meta fixes the body. In English it is "<code> is your verification code." You can add Meta's security line, "For your security, do not share this code.", and an expiry footer, "This code expires in <N> minutes.", where code_expiration_minutes is between 1 and 90. Each language version uses Meta's own fixed translation. URLs, media and emojis are not supported.

You choose the button. Copy code works everywhere. One-tap autofill opens your Android app with the code and needs your package name, signature hash and a handshake. Zero-tap (Android only) has no button: WhatsApp broadcasts the code straight to your app. On iOS 26 and later, keyboard suggestions offer the code from the notification with no integration. The code can be up to 15 characters and appears twice in the send request, as the body parameter and as the button parameter (sub_type "url"). Copy code button text is limited to 25 characters. Set message_send_ttl_seconds so stale codes are not delivered late. Meta also delivers authentication messages on Cloud API only to the user's primary device; linked devices see a masked prompt.

Security checklist and fallback strategy

The message is the easy part. Most OTP fraud and cost overruns come from weak rules around it. These are widely used recommendations, not legal requirements. Adapt the numbers to your own risk.

Use a cascade for delivery. Try WhatsApp first where the user has it, fall back to SMS after a short timeout (for example 30 to 60 seconds without a delivery receipt), and offer a voice call that reads the code as a last resort for landlines and poor coverage. In the GCC, OTP is transactional traffic, so promotional rules such as the UAE "AD-" sender prefix do not apply. Your sender ID still has to be registered in most markets, so check local rules before launch.

• 6 digits is the common default; generate codes with a cryptographically secure random generator.
• Short validity (5 to 10 minutes), single use, and store only a hash of the code.
• Rate-limit sends per phone number and per IP, enforce a resend cooldown, and lock after about 5 wrong attempts.
• Prevent SMS pumping (artificially inflated traffic) by allowing only the destination countries you serve.
• Never put the code in a link or the URL, and never ask users to read it to an agent.