A one-time password (OTP) is the six-digit code that arrives by SMS to confirm a login, a payment, or a new account. It's the most common form of two-factor authentication (2FA) in Nepal today, precisely because it doesn't require the recipient to install anything, every phone that can receive a call can receive a text.
What actually happens, step by step
- A user takes an action that needs verification: logging in, resetting a password, confirming a phone number at signup.
- The application generates a short-lived, random code and sends it as a single SMS to the number on file.
- The user reads the code off their phone and types it back into the application within a short window, a few minutes, typically.
- The application checks the code matches and hasn't expired, and only then completes the action.
The entire value of the mechanism rests on one property: only the person holding that specific phone can read the code. That's why SMS OTP counts as “something you have”, a second factor, distinct from “something you know” (a password).
This isn't hypothetical: it's how Bullet SMS itself onboards clients
Why SMS OTP is still hard to beat
Authenticator apps and push-based 2FA are more secure in some respects, but they require the user to already have the app installed, a real barrier for a first-time signup. SMS OTP works on every phone, smart or not, with zero setup, which is exactly why it remains the default second factor for banking, e-commerce, and account registration across Nepal.
What makes an OTP send reliable
- Low latency. A code that arrives two minutes late is useless; OTP sends need to be treated as high priority, not batched with marketing traffic.
- A trusted, consistent sender ID. Recipients learn to trust codes from a specific, recognizable name, inconsistent sender IDs train users to ignore or distrust the message. See what a sender ID actually is and why it matters.
- A short, unambiguous message. A code, an expiry window, and nothing else; anything longer risks the message splitting into extra segments for no benefit.
Technically, an OTP is just a single SMS to a single recipient; no bulk-sending features are needed, which is why the same “Single SMS” send or a direct API call handles it cleanly, without needing a separate, dedicated OTP product. For which of those two fits an OTP flow best, see SMS API vs. bulk SMS dashboard.