How Long Do Verification Codes Last? OTP Expiry Explained
How long do verification codes last? There is no universal expiry time. The service that issues a code sets its validity, and its configuration can change the answer. Auth0's passwordless email OTP documentation gives a default of 3 minutes; Supabase's email OTP documentation gives 1 hour. An authenticator's rotating TOTP is a different mechanism. Follow the current instructions on your verification screen, and request a fresh code through the official flow when needed.
This is a documentation-based guide, not a measured delivery test or a promise that any platform accepts Inboxto addresses.
Official Examples, Not a Universal Countdown
A six-digit number does not tell you how long it remains valid. These official examples illustrate different designs:
| Mechanism | Documented timing | Important qualification |
|---|---|---|
| Auth0 passwordless email OTP | 3-minute default validity | Configurable; only the last issued OTP or link is accepted |
| Supabase email OTP | 1-hour default validity | Configurable; the default request interval is 60 seconds |
| Time-based OTP in RFC 6238 | Recommended 30-second time step | A generation interval, not a universal acceptance deadline |
These are provider defaults, not rules for every website using those providers. A site owner can configure a different policy. A code may also become unusable before its time limit if it was consumed, replaced, or rejected under another security rule.
For the larger workflow, see receiving verification codes without your real inbox.
Why Codes Expire and Resends Matter
Short validity limits how long an exposed code remains useful to someone else. Expiry works alongside other controls, such as attempt limits and single use; it is not the whole security system.
Auth0 explicitly documents that issuing a new passwordless OTP or link invalidates earlier ones, and using the latest one invalidates it too. That rule is specific to the documented Auth0 flow. Other services may handle resends differently, so check their instructions rather than assuming every resend replaces every previous code.
Avoid repeatedly clicking resend. It can create several messages whose arrival order is confusing, while the service may enforce a cooldown. Supabase documents a default 60-second request interval for email OTP. That is not an expiry duration and does not mean another service has the same cooldown.
Keep Three Clocks Separate
Our editorial troubleshooting framework separates token validity, email delivery, and inbox retention. They answer different questions: will the service accept this code, when did its message reach you, and how long can you read the message?
Consider a hypothetical service with a ten-minute validity window starting at issuance. If its email arrives eight minutes later, roughly two minutes remain, not a fresh ten minutes. This is an illustrative calculation, not an Inboxto latency measurement. Actual services define their own starting points and rules.
Inboxto's public FAQ says addresses remain active until deleted. Its Free plan has 3 persistent addresses, ordinary mail retained for 7 days, and 5 permanently starred messages. Premium has unlimited addresses, ordinary mail retained for 90 days, and unlimited starred messages.
Those storage limits cannot extend a sender's OTP window. Starring a message preserves the message, not the code's validity. An inbox can still show a code long after the issuing service has stopped accepting it. Conversely, a persistent address is useful for requesting another message only while you still control and can access it. Our temporary-email explanation covers the mailbox side of this distinction.
Five Steps When a Code Is Expired or Invalid
- Check the verification screen. Read the expiry notice, error, and resend instructions. Confirm you are using the official site or app and the correct account or signup flow.
- Check the destination and request. Open the inbox for the address displayed by the service. Match the message to the request you just made; do not rely solely on which message arrived last.
- Request once when allowed. If the code expired, use the official resend control and respect its cooldown. Follow that service's rule about older codes; avoid mixing codes from multiple requests.
- Copy the original code carefully. Preserve leading zeros and check for extra spaces. Use the actual message, not an AI paraphrase, to enter the value into the official flow.
- Stop repeated failures. If a fresh code still fails, use the service's documented troubleshooting or support options. Do not guess codes, bypass attempt limits, or keep creating new inboxes to evade restrictions.
If you cannot find the message, our verification-email inbox guide helps check the destination and inbox separately from expiry.
Email Codes, Confirmation Links, and TOTP Differ
A numeric email OTP is not necessarily shorter-lived than a clickable link. Supabase documents one-hour defaults for both email OTP and magic links; its Email OTP Expiration setting also governs several email-link types. Format alone does not determine expiry.
For link problems, read fixing confirmation links that do not work. Opening a retained message does not revive an expired or already-used link.
Authenticator TOTP is generated from a shared secret and time, rather than delivered by email. RFC 6238 recommends a 30-second time step and discusses clock drift and validation windows. Device time synchronization can matter there. Changing your displayed timezone or clock does not make an expired server-issued email code valid again. Inboxto is an email product, not an authenticator or SMS service.
What Inboxto Can Help With
Keeping a dedicated address available can reduce the inconvenience of recreating an inbox for a legitimate new request. But optional sign-in and cross-device access must be configured appropriately; an unsigned browser session is not a guaranteed recovery path. For long-term accounts, review persistent email and account recovery.
Inboxto offers AI summaries: five per day on Free and unlimited on Premium. They can help you understand a message, but are not a guaranteed code extractor, a delivery accelerator, or a security verdict. Inspect the original email before acting. We do not claim measured instant delivery or guaranteed acceptance by the issuing platform.
Do Not Archive Active Codes as Recovery Secrets
Keep a non-sensitive setup confirmation if it is useful, rather than collecting live reset links or codes indefinitely. A saved expired OTP cannot recover an account. Recovery codes supplied separately by a platform are different from a one-time email code; protect them using that platform's guidance and independent secure storage.
Never share a login code with someone claiming to be support. If you did not request the message, investigate through the service's official site instead of treating the email as an instruction to sign in.
Sources and Your Next Step
Public sources reviewed on October 7, 2026:
- Auth0: Passwordless authentication with email.
- Supabase: Passwordless email login.
- RFC 6238: Time-Based One-Time Password Algorithm.
- Inboxto: Public FAQ and plan limits.
Check the issuing service's expiry and resend rules first. For legitimate inbox separation, try Inboxto, keep access to your address, and remember: storing an email does not extend its verification code.