We analyzed FreePhoneNum's public archive of SMS verification messages to answer questions developers and security teams actually ask: How long is a typical one-time passcode? How many texts even contain a code? And which services send the most verification SMS?
of verification codes are 6 digits — the clear default
of all SMS contain a numeric code; the rest are notifications
characters — the average verification SMS length
Across the codes we detected, six-digit codes dominate at 60.8%, with four-digit codes a distant second at 26.8%. Five, seven and eight-digit codes are comparatively rare. If you're designing an OTP input, six digits is the safe default — and supporting four digits covers the vast majority of the rest.
Of the messages where we could identify the sender, Google sends the most verification texts by a wide margin, followed by Amazon, Instagram, Facebook and Telegram. This mirrors which services most aggressively require phone verification.
Share of all sampled messages. Bars are relative to the top sender (Google).
Figures come from FreePhoneNum's publicly displayed SMS archive — messages received by free disposable numbers between 2017 and 2024. Code-length and sender distributions are computed from a representative sample of 617,628 messages (every 15th message across the full archive). Codes were detected with a numeric-pattern parser; senders were identified by brand keywords in the message body, so the sender shares are a lower bound (messages with no recognizable brand name are excluded from that chart). You're welcome to cite or link to this page — a credit to FreePhoneNum is appreciated.