Generate and Verify OTP Codes in Plain Java

Last updated: October 14, 2026

One-time passwords sit at the heart of most two-factor authentication systems today. Whether you are logging into a banking app, resetting a forgotten password, or confirming a transaction, OTPs provide that extra layer of security by being valid for a single use only. For developers building authentication flows, understanding how to generate and verify these codes programmatically is a foundational skill.

This guide walks through two approaches for generating OTPs in Java. The first creates a simple numeric code, while the second adds verification logic to confirm the code entered by a user matches what the system generated. Both examples use only built-in Java libraries, so you can run them immediately without installing additional dependencies.

Understanding the OTP Code Structure

OTP stands for One-Time Password. It is a randomly generated combination of characters or digits used to authenticate a user for a single transaction or session. The key properties are that each code is unique, expires after one use, and cannot be easily predicted by an attacker.

In most real-world applications, OTPs appear as short numeric strings. Four to six digits is common, with four-digit codes frequently used for low-stakes verification and six-digit codes preferred for higher-security scenarios. The short length makes them easy to type on a mobile device while remaining difficult to guess randomly.

Generating a Numeric OTP

The simplest approach uses a loop to build a string digit by digit. Each iteration calls Random.nextInt(10) to produce a value between 0 and 9, then appends that digit to a running string. Here is a complete working example:

“`java

Import java.util.Random;

Public class OTPGenerator {

Public static String generateOTP(int length) {

String result = "";

Random random = new Random();

For (int i = 0; i < length; i++) {

Result += random.nextInt(10);

}

Return result;

}

Public static void main(String[] args) {

System.out.println("Your verification code: " + generateOTP(4));

}

}

“`

When you run this program, the output displays something like "Your verification code: 8472". Changing the argument in generateOTP(4) to generateOTP(6) produces a six-digit code instead. This flexibility makes the method reusable across different authentication requirements.

Adding Verification Logic

Generation alone is only half the picture. A complete authentication flow needs to compare the code entered by the user against the one the system created. The String.equals() method handles this comparison safely:

“`java

Import java.util.Random;

Import java.util.Scanner;

Public class OTPVerifier {

Public static void verify(int length) {

String systemOTP = "";

Random random = new Random();

For (int i = 0; i < length; i++) {

SystemOTP += random.nextInt(10);

}

System.out.println("System code: " + systemOTP);

Scanner scanner = new Scanner(System.in);

System.out.print("Enter the code you received: ");

String userOTP = scanner.nextLine();

If (systemOTP.equals(userOTP)) {

System.out.println("Verification successful");

} else {

System.out.println("Code mismatch, please try again");

}

}

Public static void main(String[] args) {

Verify(4);

}

}

“`

This program generates a code, displays it for testing purposes, then waits for user input. If the entered value matches exactly, the verification succeeds. Any difference in characters triggers the failure message. In a real application, you would not print the system code to the screen; it would be sent via SMS or email instead.

Practical Considerations for Production Use

The examples above work well for learning and for internal tools, but production authentication systems need additional safeguards. Foremost among these is replacing Random with SecureRandom, which produces cryptographically stronger randomness. Predictable random number generation can undermine the entire purpose of an OTP system.

Time-based OTPs represent another important evolution. Rather than generating a random code, these systems derive the current value from a shared secret and the current timestamp. This approach, standardized as TOTP, enables compatibility with authenticator apps like Google Authenticator. Libraries implementing RFC 6238 handle the complex mathematics behind the scenes while exposing a simple API.

Rate limiting matters as well. An attacker could theoretically try all possible combinations programmatically. Implementing lockouts or delays after repeated failures makes such brute-force approaches impractical. Most production systems also expire codes after a short window, typically two to five minutes, reducing the window available for attack.

Say you are building a password reset feature for an Android application. You could generate a four-digit OTP when the user requests the reset, store it temporarily in your backend, and text it to the registered phone number. When the user enters the code, your server compares it against the stored value and either proceeds with the reset or rejects the attempt. The Java logic shown here forms the core of that server-side generation step.

Key takeaways

• Random.nextInt(10) produces digits from 0 to 9, suitable for building numeric OTP strings.
• String.equals() performs case-sensitive comparison; use it instead of == for string matching.
• SecureRandom provides cryptographically stronger randomness than the basic Random class.
• Time-based OTP algorithms offer improved security and work across multiple platforms and authenticator apps.
• Rate limiting and code expiration are essential protections for production authentication systems.