Generate OTP codes with your platform's cryptographically secure random generator, pick a uniform number in the range, and left-pad with zeros so leading zeros are kept. Never use a seeded or time-based generator, because an attacker who guesses the seed can predict every code.
Safe calls by language
- Node: crypto.randomInt(0, 1000000), then padStart(6, "0")
- Python: secrets.randbelow(10**6), then zfill(6)
- Go: crypto/rand with rand.Int and a big.Int limit
Common mistakes
- Using Math.random, random.randint or math/rand. These are not designed to resist prediction.
- Taking a random byte modulo 10, which skews digits. Use a function that accepts an upper bound.
- Storing the code as an integer, which silently drops the leading zero and breaks comparisons.
- Logging the plain code anywhere.
If you do not need to own code generation, an API can do it for you. Tambua generates the code at your configured length unless you pass your own 4 to 10 digit code.
Need OTPs that reach users across Africa? Read the API docs or get a free test key.