Back to Business Mode
OTP Verification
OTP codes are short by design, which means they're also guessable by design — the real defense is limiting how many guesses are possible.
OTP codes are single-use and expire within minutes
Attackers can script sequential guesses (111111, 222222...) in seconds without rate limiting
Rate limiting and progressive lockout make brute force mathematically infeasible
Repeated failures trigger account protection, not just request blocking
Hands-on demo
Legitimate Verification
Attacker: Sequential Brute Force
Request a code above first, then launch the attack — an automated script tries the simplest possible 6-digit codes in sequence.
Try it yourself
Try it yourself — run a scenario below, then flip this and replay it to see what changes.
Normal OTP Flow
The legitimate owner requests and enters a code from their own device.
Want this flow explained in detail as it plays?
app.flowground.dev/verify
Confirm your phone
Phone
+1 •••-•••-4821
User
App
Device
A 6-digit code is generated server-side and sent via SMS to the registered device.
Selected hop
User requests a one-time code
User
The person using the app.
App
The application's backend — enforces business rules and decides what every request is allowed to do.
What happens here
A 6-digit code is generated server-side and sent via SMS to the registered device.