Testing OTP Emails

OTP (one-time password) emails are the security backbone of many modern authentication systems. Testing them thoroughly is essential for account security and user experience.

The OTP flow

User requests OTP. User enters their identifier (email, phone, username) in an OTP request form.
Application validates user existence. The application checks that the user exists and is eligible for OTP delivery.
OTP generation. The application generates a random numeric code (typically 4-8 digits) with expiration (typically 5-15 minutes).
OTP storage. The OTP is stored in the database associated with the user account or session.
Delivery channel selection. The application sends the OTP via email, SMS, or both.
User receives OTP. The user receives the code via their chosen channel.
OTP entry. The user enters the code in the verification form.
OTP validation. The application checks that the code matches, has not expired, and has not been used.
Authentication completion. On validation, the user is authenticated or the transaction is completed.
OTP invalidation. The OTP is immediately invalidated after successful use.

Security testing

Token randomness: Are OTPs cryptographically random and unpredictable?
Token length: Is the OTP length appropriate (4-8 digits)? Shorter codes are easier to guess; longer codes are harder to type.
Token expiration: Do OTPs expire at the correct time?
One-time use: Can an OTP be used multiple times?
Rate limiting: Can an attacker request unlimited OTPs to brute-force codes?
Account lockout: Does the account lock after N failed OTP attempts?
Token leakage: Are OTPs exposed in logs, URLs, or error messages?

Channel testing

Email delivery: Do OTP emails arrive reliably within expected timeframes?
SMS delivery: Do SMS OTPs arrive reliably across different carriers?
Multi-channel sync: If both email and SMS are sent, do they contain the same code?
Channel fallback: What happens if one channel fails?

Usability testing

Code clarity: Is the OTP clearly visible and easy to distinguish from other text?
Code entry: Is the OTP easy to type without errors?
Mobile support: Does the OTP entry work well on mobile devices?
Accessibility: Is the OTP flow accessible to screen readers?
Error handling: What happens when the OTP is expired or invalid?
Resend functionality: Can users request a new OTP if the first expires?

Edge cases to test

Expired OTPs: Test with tokens that have already expired.
Invalid OTPs: Test with randomly generated codes.
Multiple concurrent requests: What happens if the user requests multiple OTPs in succession?
Account state changes: What happens if the account is disabled between OTP generation and entry?
Device switching: Test OTP flow when the user switches devices mid-process.
Network issues: What happens if the network disconnects during OTP entry?

Using temporary email for OTP testing

Temporary email is excellent for testing OTP email delivery:

Generate a fresh address for each OTP request to test clean state
Verify that OTP emails arrive and codes are correctly detected and displayed
Test with different email providers to ensure compatibility
Confirm that OTP detection works even when emails contain HTML or attachments

For SMS OTP testing, use a real phone number or a test number service. Temporary email does not support SMS.

Questions

Should OTPs be the same across email and SMS?

Yes, consistency improves user experience. Users may not care which channel receives the code. However, ensure your system can handle the case where one channel fails or is not available.

How do I test OTP resilience to brute force attacks?

Test rate limiting by simulating rapid OTP requests from different IPs. Ensure your account lockout triggers after a reasonable number of failed attempts (typically 3-5). Log all OTP attempts for security monitoring.