What an OTP email is
An OTP email, or email OTP, is a one-time password sent by email: a short code that you type back into an app or site to prove you can read that inbox, usually to sign in or confirm an action. The code works once and usually expires within minutes.
We collected 91 from 66 brands in two ordinary inboxes, 90 of them sent in 2023 or later, and show 24 here, one per brand. The percentages describe all 91.
Browse all 24 OTP emails
Filter by industry, or search a brand or subject line. Open any email to see it full length, with its subject line, notes on what it is doing, and a prompt that rebuilds it.
Netflix
Netflix: Your sign-in code
Oura
One time password
Link
Your verification code: [ACCOUNT_NO]
Hubbl
Your one-time verification code for Hubbl
nib
nib verification code: [ACCOUNT_NO]
IKEA
One-time code to access your IKEA account.
Xero
Your verification code
Medibank
One-time verification code
Nike
Here's your one-time code
Crypto.com
Crypto.com Verification Code
Google Verification Code
TP-Link
Tapo Account Verification Code
viagogo
Your viagogo One Time Pin: [ACCOUNT_NO]
myID
myID verification code
WhatsApp Verification Code: [ACCOUNT_NO]
Ubisoft
Ubisoft Account Security Code
ABC
Your one-time code is [ACCOUNT_NO]
Shop
Sign in to Shop
Substack
[ACCOUNT_NO] is your Substack verification code
Samsung account
Verification code for signing in
American Express
Your American Express One-Time Verification code
Services Australia
Your PRODA verification code [SEC=OFFICIAL]
Latitude Financial Services
Your verification code
ReportCyber
ReportCyber - One Time Password (Do Not Share)
How OTP emails differ from the rest of the inbox
OTP emails against verification emails and everything else
91 OTP, 149 verification and 12,620 other emails from the same two inboxes| What we measured | OTP | Verification | Every other email |
|---|---|---|---|
| Sent at the security stage (sign-in, access) | 98% | 16% | 2% |
| No call to action besides the code | 35% | 27% | 5% |
| Plain-text layout | 85% | 60% | 31% |
| Micro length | 60% | 62% | 12% |
| Plain subject line that says what it is | 98% | 92% | 32% |
| Monochrome color | 99% | 92% | 62% |
| Greets by first name | 15% | 30% | 40% |
| Hero image | 0% | 0% | 12% |
| Median calls to action | 1 | 1 | 2 |
OTP and email verification emails look alike, short, plain and monochrome, but they do different jobs. 98% of OTP emails arrive at the security stage, when someone signs in or accesses an account, against 16% of verification emails, which mostly confirm a new address. OTP emails are also barer: 85% use a plain-text layout against 60%, and 35% have no call to action besides the code, against 27% of verification emails and 5% of everything else. Only 15% greet the reader by first name. “Every other email” is all 12,620 non-OTP emails from the same inboxes, verification included.
What is in the collected set
The call to action in the 91 OTP emails
all 91 collected| Call to action | Emails | Share |
|---|---|---|
| A text link | 58 | 64% |
| None besides the code | 32 | 35% |
| A button and a text link | 1 | 1% |
Where the 91 OTP emails came from
all 91 collected| Region | Emails | Share |
|---|---|---|
| Australia | 42 | 46% |
| US | 24 | 26% |
| Europe | 9 | 10% |
| Asia | 2 | 2% |
| Elsewhere or unclear | 14 | 15% |
The 91 come from 19 named industries, plus 4 we could not place. SaaS (14), media and publishing (13), government (9) and fintech (7) are the largest; no other industry has more than 5. By year, 22 were sent in 2026, 31 in 2025, 29 in 2024, 8 in 2023 and 1 in 2020. In the grid, 20 of the 24 use a plain-text layout and 12 come from Australian senders.
What the shown emails have in common
The code sits in the first lines. Hubbl puts it in the opening sentence (“This is your one-time verification code from Hubbl”), and Netflix gives it a line of its own under “Enter this code to sign in”. Of the 24 shown, 17 name a lifetime for the code. It runs from 3 minutes (Hubbl) and 4 minutes (Ubisoft) to 60 minutes (Xero) and 4 hours (WhatsApp); 10 minutes is the most common, in 7 of the 17.
Some also say who will never ask for it. Latitude Financial Services opens, in capitals, with “DO NOT SHARE THIS CODE WITH ANYONE, INCLUDING LATITUDE STAFF”, and ReportCyber, the Australian government’s cyber crime reporting service, says “No one from the Police or a Government Agency will ever ask for this code.”
Next to this one
The same library, cut by the job the email does: email verification emails, password reset emails, security alerts and account notices.
Questions about OTP emails
It is an email that carries a one-time code you type back into an app or site to prove you own the address, usually to sign in. Of the 91 we collected, 98% were sent at the security stage, when someone signs in or accesses an account, and 35% have no call to action besides the code.
It comes from the service you are signing in to, so search your inbox and spam folder for that brand or for the word “code”: 80 of the 91 OTP emails we collected, or 88%, have it in the subject line. Codes expire fast, often in 10 minutes, so request a new one if it is late.
An OTP email you did not ask for usually means someone typed your address into a sign-in form. The real ones say so: Netflix and nib tell you to ignore the email if you did not request it, and Latitude says not to share the code with anyone, its own staff included. Never pass a code on to someone who asks for it.
Open any of the 24 emails above to see it full length, with its subject line, notes on what it does, and a prompt you can paste into an AI assistant to build your own version. For the other emails a product sends, see transactional email templates.
So far 36 of the 91 have been rendered full length for this library. We removed four that showed something about the person who received them (a surname, a device and IP address, the end of a card number), one whose sender reveals a private service, three that did not load or render complete, and four repeat sends of the same template. That leaves 24 from 24 brands. The rest are counted in the percentages but not shown yet.