Use six digits unless you have a specific reason not to. Six decimal digits is the typical minimum in standards such as RFC 4226 and NIST SP 800-63B, and it is short enough for people to read and type from a notification.
Length versus guessing
A six digit code has one million possibilities. With five wrong guesses allowed, a blind attacker has roughly a five in a million chance per code. Four digits cuts the space to ten thousand, so the same five guesses are far more dangerous, which is why four digits needs tighter limits and shorter expiry.
Practical guidance
- Choose six for login, signup and recovery.
- Consider eight only where users copy codes from a screen, not type them from memory.
- Never trade length for convenience without tightening attempts.
- Keep the length a setting, not a hard-coded constant.
Length and attempt limits work together. Tambua lets you set code length from 4 to 10 digits per app, with six as the default, so you can change it without a deploy.
Need OTPs that reach users across Africa? Read the API docs or get a free test key.