# OTP message template generator > Build a one-time-code SMS or WhatsApp-style message: code first, brand, expiry, don't-share line, Android app hash, iOS domain-bound code and segment count. Canonical: https://mobilevalidate.com/tools/otp-message-template-generator · Last updated: 2026-11-07 Enter your brand and choose the code length, expiry, language and channel. The generator writes a one-time-code message that puts the code first, names the brand, states the expiry and warns not to share the code, with optional lines for Android's SMS Retriever and iOS domain-bound codes. It checks each rule and shows the SMS encoding and segment count before you copy it. Use the tool: https://mobilevalidate.com/tools/otp-message-template-generator (interactive; needs a browser with JavaScript). **Privacy:** Runs entirely in your browser. Nothing you type, paste or upload is sent to MobileValidate or anyone else, and nothing is stored. The page counts one anonymous "tool used" event per visit (no numbers, no text), and sends nothing at all when your browser asks not to be tracked. ## How it works The message follows the rules most security teams and messaging providers agree on: the code first, so it shows in the notification preview; your brand, so people know who sent it; how long the code is valid; a line asking people not to share it; and no links, which carriers filter and which teach people to tap links in codes. **Android SMS Retriever.** Apps that read the code without the SMS permission need the message to contain the app's 11-character hash string and to be at most 140 bytes. Paste your hash and it goes on its own line at the end; the byte count is checked. **iOS and Safari domain-bound codes.** When the last line is `@` plus your domain, a space and `#` plus the code, phones offer to autofill the code only on that website, which protects against look-alike phishing sites. Enter the domain and the line is added. The SMS is counted with the same segmenter as our [SMS character counter](https://mobilevalidate.com/tools/sms-character-counter). Spanish, Portuguese and some French letters fall outside GSM-7 and make a message Unicode, with 70 characters per segment; tick plain letters to replace them, or keep the accents if wording matters more than cost. ## Check the number before you send the code An OTP to a dead, landline or VoIP number costs money and can be a sign of fraud. Check whether a number is live and what kind of line it is before you send. - [Start free (20 free real checks)](https://mobilevalidate.com/request-access) - [HLR lookup](https://mobilevalidate.com/services/hlr-lookup) - [Carrier and line type lookup](https://mobilevalidate.com/services/carrier-lookup) ## Related - [OTP fraud prevention: the checks to run before you send a code](https://mobilevalidate.com/blog/otp-fraud-prevention-checks-before-sending-a-code.md) - [OTP cost by country: WhatsApp authentication rates, SMS cost drivers and the cost of a wasted code](https://mobilevalidate.com/blog/otp-cost-by-country.md) - [WhatsApp OTP vs SMS OTP: cost per verified user, with a calculator](https://mobilevalidate.com/blog/whatsapp-otp-vs-sms-otp-cost.md) - [OTP bombing: how to protect your send-code endpoint](https://mobilevalidate.com/blog/otp-bombing-protection.md) - [SMS character counter: GSM-7, Unicode and segments](https://mobilevalidate.com/tools/sms-character-counter.md) - [SMS GSM-7 converter: remove characters that force Unicode](https://mobilevalidate.com/tools/sms-gsm-converter.md) - [One-time password (OTP)](https://mobilevalidate.com/glossary/one-time-password-otp.md) ## Frequently asked questions ### What should an OTP SMS say? The code, first; who it is from; how long it is valid; and that it must not be shared. For example: "482913 is your Acme verification code. It expires in 10 minutes. Don't share it with anyone." Leave out links and anything that looks like marketing. ### Why should the code come first? Phones show the start of a message in the notification. With the code first, people can read it without opening the message, and the phone's autofill finds it more easily. It also keeps the code visible when a long message is cut in the preview. ### How do I make the code autofill on iPhone? iPhones suggest codes from recent messages in most cases. To bind the code to your website, so it is offered only there, end the message with a line such as `@example.com #482913`: the domain where the code is typed and the code itself. ### What is the Android SMS Retriever hash? An 11-character string computed from your Android app's package name and signing certificate. When an SMS contains it, the Google Play services SMS Retriever API hands the message to your app without the app needing permission to read SMS. The message must be at most 140 bytes. ### Why is my Spanish or Portuguese OTP two segments? Letters such as ó, ç and ã are not in the GSM-7 alphabet, so the whole SMS is sent as Unicode, which holds 70 characters per segment instead of 160. Tick plain letters to replace them, or shorten the text. See the [GSM-7 converter](https://mobilevalidate.com/tools/sms-gsm-converter). ### Can I use this text for WhatsApp authentication templates? Not word for word. WhatsApp Business authentication templates use preset wording with optional security and expiry lines, so you choose options rather than write the text. The WhatsApp-style output here is for regular chat messages, or as a reference when you set the template's options. ### Should I check the number before sending an OTP? For sign-ups and high-value actions, yes. Codes sent to numbers that are switched off, landlines or VoIP ranges cost money and are a common route for SMS pumping fraud. An [HLR lookup](https://mobilevalidate.com/services/hlr-lookup) shows whether a number is live, and a [carrier lookup](https://mobilevalidate.com/services/carrier-lookup) its line type. See [checks before sending a code](https://mobilevalidate.com/blog/otp-fraud-prevention-checks-before-sending-a-code).