Verification codes are a bit maddening, because they usually turn up right in the middle of something. You're on a payment screen, about to download a file, or trying to log in to your account from a new device. There are six empty boxes on the screen and your inbox is empty.
In this article we look at one-time codes sent by email in general. Then we cover what to watch out for when you want to receive them at a temporary address, and which accounts you should never do that with.
What is an OTP?
An OTP (one-time password) is a verification code that works only once and only for a short time. It's usually 4 to 8 digits long; some sites use letters too. Its job is to show that the person who has access to that email address right now really is you.
You'll most often see codes by email when:
- you're creating a new account and need to verify your email address
- you're logging in from an unrecognised device or location
- you're using passwordless login ("email me a code")
- you're resetting a password or changing a sensitive account setting
Why doesn't the code arrive? The most common reasons
Most causes fall into three groups, namely the address, the site sending the code, and what you did. The third group gets talked about least but happens most.
The address
The code goes to the address the site has on file, not the one you happen to be looking at. On an account opened years ago, that might be a different address. On a new sign-up, there might be a typo. If the site shows a hint like "we sent a code to u***@...", read it carefully.
The sending site
Some platforms send codes through a queue, and there can be delays at busy times. Others restrict sending codes to certain email providers or to temporary email domains. In that case the code never arrives, and you may not see any warning either.
What you did
Here's the trap people fall into most. They press "resend" three or four times when the code doesn't show up. Most systems cancel the previous code with every new request. Then the delayed emails arrive one after another, you enter the first one you open and get "invalid code". On top of that, firing off request after request can make the site lock you out for a while.
How long is a code valid?
There's no single answer; every site decides for itself. We typically see anything from a few minutes to a few tens of minutes. Most sites state it in the email or on the code entry screen ("This code is valid for 10 minutes", for example).
The practical rule is to use the code as soon as you see it. If you get distracted while waiting for the email and come back half an hour later, you'll probably need to request a new one.
How do resend limits work?
To prevent abuse (someone sending hundreds of codes to another person's address, for instance), sites put limits on the resend button. These limits usually show up in a few ways:
| Type of limit | What you see on screen | What to do |
|---|---|---|
| Cooldown | "You can resend in 60 seconds" with a countdown | Keep an eye on your inbox until it runs out, then press once |
| Request limit | "Too many attempts" | Wait a while (sometimes an hour or more) |
| Wrong code limit | The process locks after a few incorrect codes | Copy and paste the code instead of typing it |
| Temporary account lock | Login blocked for security reasons | Follow the site's support or account recovery steps |
Do yourself a favour and wait at least a minute after pressing the button. More often than not, the code arrives within that minute.
What to do, step by step, when the code doesn't arrive
- Check the address. Is the address the site sent the code to the same one you're looking at?
- Wait a minute or two. Refresh your inbox. In a regular mailbox, check spam and tabs like "Promotions" too.
- Resend once. Only once, and only after the site's cooldown has ended.
- Use the latest code. If several emails arrived, open the newest one.
- Copy the code. When typing by hand, 0 and O or 1 and l are easy to mix up. Make sure there's no space at the start or end.
- Try another method. If the site offers a text message or an authenticator app, use that.
- Still nothing? Contact the site's support. They're the ones sending the code; only they can see what's going wrong.
Getting a verification code with a temporary email
This is exactly why many people use Geçici Mail. They want to sign up to a site they'll use once, get the code and keep their main address off that site's newsletter list. In this scenario things usually move fast. The inbox refreshes itself every 5 seconds, and in our own tests an email shows up in 3 to 5 seconds on average. When the code arrives, a notification sound plays and the tab title shows a new email notice.
Still, a temporary address has a few quirks of its own:
- Keep the page open. The address is valid for 3 hours, and the time extends while the page is open. Don't close the tab while you're waiting for a code.
- Save your recovery key. The same site may ask for a code again months later. With the XXXX-XXXX key shown below the address box, you can get back to the address; we explain how in our recovery key guide.
- Old codes don't stick around. Incoming emails are deleted automatically after 24 hours. Codes expire long before that anyway, but if the email contains anything else (an order number, say), keep that in mind.
- Some sites don't send codes to temporary addresses. If the code never arrives while emails from other sites come through fine, that's most likely why. We've collected all the possible causes in not receiving emails on a temporary address.
Which accounts should never use a temporary email for codes?
We want to be clear about this. A temporary address should never be an account's permanent identity. Even though the recovery key lets you return to the address, the day you lose the key you also lose access to every code sent there. The more important the account, the bigger that risk.
| Fine for a temporary email | Not fine for a temporary email |
|---|---|
| A one-off sign-up to download a file | Banking, payment and crypto accounts |
| A shop account just to get a discount code | Government portals and official services |
| Reading a single thread on a forum | Your main email, cloud storage, password manager |
| A trial account to test an app | Work accounts, paid subscriptions |
| One-time forms like a Wi-Fi login page | A social media account you plan to keep |
For the accounts in the right-hand column, the verification code is the key to your account. The address it lands in needs to be yours, permanent and well protected. If you're curious about the security side of temporary email, take a look at is a disposable email safe.
One more security warning
If you get a verification code you didn't ask for, someone may be trying to get into your account. Don't share that code with anyone. Anyone who calls and says "we've sent you a code, could you read it out?" is someone who shouldn't be asking for it, whoever they claim to be. Real companies never ask you for a code they've just sent you.
FAQ
Why does it say my verification code is invalid?
The most common reasons are that a resend request cancelled the old code, or the code expired. Enter the code from the most recent email, copying and pasting it.
How many times can I press resend?
Each site sets its own limit. The general advice is to press once after the cooldown ends, then wait at least a minute; repeated requests can lead to a temporary block.
Can I get a verification code with a temporary email?
Yes, on most sites you can, and the code usually arrives within seconds. However, some sites don't send codes to temporary addresses, and you shouldn't use a temporary address for important accounts.
Can I see a code sent to my temporary email again later?
Incoming emails stay in the inbox for 24 hours and are then deleted automatically. With your recovery key you can return to the address and request a new code from the site.