How fast should an OTP arrive? We timed it

A one-time passcode is only useful in the moment someone is staring at the screen waiting for it. If it shows up after they have already given up, it might as well not have come at all. So how fast is fast enough?

The number that matters

For a code someone is actively waiting on, aim for under five seconds from request to phone. Under ten is acceptable. Past fifteen and you start losing people: they hit resend, get two codes, get confused, and some just close the app.

We watched a sign-up flow where codes averaged 22 seconds. Nearly one in five people dropped off at that step. When delivery came down to four seconds, that drop-off more than halved. Same app, same code, faster delivery.

What slows a code down

• Long routes. Every extra hop between you and the network adds delay. A direct connection to the carrier is faster than a message that bounces through three aggregators first.
• The wrong queue. If a network is congested, a code queued behind a bulk campaign waits its turn. OTPs should never sit in the same queue as marketing blasts.
• Retries done badly. If the first attempt fails silently and nothing tries again for 30 seconds, the user feels the whole gap.

Why the route is the whole game

Most of the delay in OTP delivery comes down to one thing: the route your provider puts codes on. If one-time passcodes travel through the same queue as bulk marketing, a big campaign will hold up a login code, and there is nothing you can do about it in the moment. Your codes end up only as fast as the busiest promo on the platform that day.

This is exactly why we route OTPs on a dedicated lane, separate from bulk traffic, so a send going to fifty thousand people cannot delay someone trying to log in. When you compare providers for OTP and bulk SMS, ask one question: do OTP and bulk share a queue? If they do, that is where your sign-ups will leak.

What else actually helps

Keep the message short, the code is the message. Give people a resend button that actually resends, with a short cooldown so they cannot spam it. And let codes expire: five minutes is plenty. A code that works for an hour is a code an attacker has an hour to use. Short life, fast delivery, separate route. Get those three right and the verification step stops being the place you lose customers.

Building sign-up or login? See how OTP and 2FA run on Hellio, on a route kept apart from bulk SMS.