2 ms·
What's the optimal length for a 2FA code?
- jqpabc123 4y ago6 seems like a good compromise, especially if the number of attempts is limited. If credentials are compromised and the code is intercepted, the length is irrelevant. Otherwise, the idea is to make the effort non-productive even if credentials are compromised. As an example, most banks will permanently lock your account after X number of unsuccessful attempts per code or Y number of code requests per day. Most sensible people will look for a more productive way to spend their time.