OTP Expired or Invalid? How Long Email Codes Last

Updated October 21, 2026 · 7 min read

An email OTP lasts as long as the website that sent it decides: commonly a few minutes, often about ten, and it works only once. “OTP expired” means that time ran out. “Invalid” usually means you typed an older code after asking for a new one, or the code picked up a typo. Request one fresh code and use only the newest email.

This guide is for anyone who typed a code and got “expired” or “invalid”, password-reset codes included. It explains what each message means, the less obvious reasons a correct-looking code fails, and how timing works when the code reaches a rented inbox or an API.

How long does an OTP last?

There is no single standard for email codes; each sender picks its own lifetime. These are the usual patterns:

If the email names a time, that is the one that counts. If it does not, the site's help page usually does. When neither says, assume minutes, not hours, and enter the code as soon as it arrives.

“Expired” or “invalid”: what each message means

Why a correct-looking code still fails

• You pressed resend. On many sites each new request cancels the previous code. Three taps can mean three emails, only the last of which works, and emails do not always arrive in the order they were sent.
• Characters got mixed up. O and 0, l and 1, or a space copied along with the code.
• Wrong tab, app or device. Some sites tie the code to the session where you asked for it, so entering it in another browser or in the app can fail.
• Wrong step or account. A login code typed into a sign-up form, or a code meant for a different account you also use.
• The clock. Authenticator codes depend on your phone's time being correct; email codes are checked by the site's server, so your device clock matters much less there.
• Attempt limits. After several wrong entries a site may lock the code, even if the next one you type is right.

What to do, in order

1. Stop typing old codes. Open the newest email and check when it arrived.
2. If it is older than the lifetime the email states, request one new code and wait for it.
3. Enter the new code in the same tab where you requested it, without spaces.
4. If it still says invalid, check that you are on the right account and the right step.
5. If you are locked out after too many attempts, wait before trying again rather than retrying in a loop.
6. If the new code never arrives, work through the checklist for missing codes.

For the basics of what a one-time code is and where it comes from, see what an email OTP is.

When the code comes to a rented inbox

On OTPGmail, the waiting window (up to 25 minutes) is the time for the first code to arrive, not the lifetime of the code. Once the code shows on your order page and the status changes from “Waiting for code” to “Completed”, the website's own clock is running: copy the code and enter it straight away.

If the website then says the code expired, request a new one on the website. A second code appears on the same order only when the service sends more than one code per inbox and the order can still receive it; the limit and window are shown on the rent page before you confirm. Where it is offered, the Get new code button on the order asks the system to wait for another code, and any charge is shown for you to confirm first. Many services send just one code per inbox, so in that case rent a fresh inbox.

One rule is worth knowing before you start: once the first code has arrived, the order can no longer be cancelled or refunded, even if the code later expires on the website. That is set out in the rental terms. Have the website's code field open before you rent, and the clock will rarely beat you.

For developers: code age and polling

If a script handles the code, timing problems are easy to rule out:

• Poll GET /v1/orders/{id} every 3–5 seconds. Codes sit in otp[], oldest first and newest last, so read otp[otp.length - 1].
• Each entry carries receivedAt in Unix seconds. Compare it with the current time to know how old a code is before you submit it.
• codeDeadlineAt is when an order still waiting for its first code is cancelled and refunded. It is the order's deadline, not the code's lifetime.
• Submit the code in the same browser session that requested it. In Playwright or Selenium, keep one context open from “send code” to “verify”.

The Gmail OTP API overview covers keys and errors, and email OTP in Selenium shows the waiting step in Java and Python.

Frequently asked questions

Is an OTP valid for 10 minutes?

Sometimes. Ten minutes is a common choice for email codes, but each sender sets its own lifetime, and some use less. The email or the site's help page tells you the exact figure.

Can I use the same OTP twice?

No. A one-time code stops working after one successful use, and on many sites it is also cancelled as soon as you request a new one.

Why did my OTP expire so fast?

Short lifetimes are a security choice, and a slow delivery eats into them: if the email took several minutes to arrive, a code with a five-minute lifetime has little time left. Compare the time the email was sent with the time you opened it, and request a new code while the page is still open.

Can an expired OTP be used again later?

No. An expired code cannot be revived or extended by the user; the only way forward is a new code from the same page.

Related guides