One-time passcode (OTP)

What does One-time passcode mean?

An OTP, or one-time passcode (also called a one-time password), is a short, single-use code sent to someone's phone or email that they enter to prove they control that channel. In e-signing, OTP verification adds a second step before the signer can view or sign a document, so a forwarded link alone is not enough.

The flow is simple. The sender adds a phone number or relies on the signer's email, the signer clicks the signing link, and the platform sends a code, often six digits, that expires within minutes. Once the code is entered, the session opens and the verification event is written into the audit trail. If the code is wrong or stale, the signer requests a new one.

Imagine an HR team sending offer letters to candidates. The link goes by email, but the team adds an SMS code to the candidate's mobile number from the application. Now, even if the email were forwarded to a colleague, only the person with that phone could sign, and the audit record shows both factors.

People sometimes treat an OTP as proof of identity. It is not quite that; it proves control of a phone number or inbox at a given moment. SIM swapping and compromised mailboxes are real, if uncommon, risks. For most business documents that level of assurance is plenty, but it is weaker than an ID document check or KBA.

OTP is a form of signer authentication and is usually the next step up from a plain email link. It pairs naturally with the audit trail, which captures when the code was sent and verified.

A few practical tips make OTPs smoother. Use the channel the signer actually checks: a mobile number for people on the move, email for desk workers. Keep expiry windows reasonable so signers are not racing the clock, and make it easy to request a fresh code. International numbers can have delivery delays, so an email fallback is worth having. Finally, tell signers in your message that a code will arrive, so the extra step feels expected rather than suspicious.

Our take: an SMS or email code is the sweet spot for documents that deserve a bit more certainty, like offer letters or payment authorizations. It adds seconds, not minutes, and signers already understand it from banking apps.

eSignSimple does not send OTPs yet; SMS and email codes are on our roadmap. Today signers receive a unique link by email, need no account, and every action is logged with timestamps, IP address and device details in the audit trail.

What is an example of one-time passcode?

An insurance broker sends a policy change form through an e-signature platform that supports SMS codes. When the client clicks the signing link, the platform texts a six-digit code to the phone number on file, and the client must enter it before viewing the form. eSignSimple does not offer OTP or SMS verification today; signers authenticate through a unique link sent to their email address.

Why didn't my one-time code arrive?

For SMS codes, the usual suspects are a mistyped or outdated phone number, a phone without signal, a carrier that filters messages from short codes or international senders, and roaming abroad. For email codes, check spam and promotions folders, corporate filters that hold messages from unfamiliar senders, and whether you are looking in the right inbox. Codes also expire within minutes, so an old code that arrives late will not work.

The fix is usually to wait a minute, request a single new code, and use only the latest one, since requesting several in a row can leave you entering a code that has already been replaced. If nothing arrives, contact the sender to confirm the number or address they entered. Senders should keep an alternative route ready, such as switching the code to email or re-sending the request to a corrected number.

SMS, email or authenticator app: which code channel is best?

Authenticator apps generate time-based codes on the device and are the strongest of the three, but they suit accounts people log into repeatedly, not a one-off signing request from someone they have never dealt with. SMS codes are familiar and work on any phone, yet they are exposed to SIM swap fraud and real-time phishing. Email codes are convenient, though if the signing link itself arrived by email, an email code proves almost nothing extra: whoever controls the inbox gets both.

That last point is easy to miss. A second factor is only a second factor if it travels through a different channel. If you want meaningful extra assurance on top of an emailed link, the code needs to go to a phone, or the access code needs to be shared by voice or in person.

What eSignSimple does instead of a passcode

eSignSimple does not send one-time codes by SMS or email. Each signer receives a unique, secret link at their email address, opens the document in the browser without an account, and every step is recorded in the audit trail with timestamps, IP address and device details. When the last person signs, the final PDF gets a certificate of completion and a hash checkable on our verify page.

For many senders that is the right trade-off, because signers complete documents faster and the evidence is still detailed. If a particular document needs a second factor, for example because a regulator requires it or the signer is unknown to you, use a provider that offers OTP for that document. Our human resources page covers which HR documents usually work fine with email signing.

Which terms are related?

• Audit trail: An audit trail is a chronological record of events in a document's signing process, such as sending, viewing and signing, with timestamps.
• Remote online notarization (RON): Remote online notarization (RON) lets a commissioned notary notarize a document over a live audio-video session using electronic signatures and seals.
• Signer authentication: Signer authentication is how an e-signature platform confirms that the person signing a document is the person it was sent to.
• Knowledge-based authentication (KBA): Knowledge-based authentication (KBA) verifies a signer's identity by asking questions drawn from public and credit records that only they should know.