E-signatures · Compared
Access code against one time code
An access code is a secret you set on a recipient and pass to them yourself, by phone or in person, before they sign. A one time code is generated when they try to sign, emailed to the address on the envelope, and expires within minutes. The first proves they know something; the second proves they control that inbox.
Both sit between sending a bare link and asking for photo identification. Choosing between them is a question about what you are actually worried about.
Nuwan Madhusanka · Co-founder
3 min read · Published · Updated
| Access code | One time code | |
|---|---|---|
| What it proves | The signer knows a secret you gave them | The signer can read the invited inbox |
| How it reaches them | You send it out of band, by phone or in person | Emailed automatically at signing time |
| Lifetime | Lasts until you change it | Expires in 10 minutes, single use |
| Weak against | Forwarding the code with the link | Anyone who already has the inbox |
| Effort for you | You must contact each signer separately | None |
What each one is really testing
A one time code sent to the invited address tests control of that inbox and nothing more. If the link and the inbox are both compromised, the code arrives at the attacker. An access code tests knowledge of something that never travelled with the link, which is why it is stronger against an intercepted email and weaker against a signer who simply forwards both to a colleague. Neither proves who the person is; they raise the cost of pretending.
How the two checks are stored and throttled here
An access code here must be at least 4 characters. It is never stored in plain text: it is hashed with salted scrypt (a 16 byte salt and a 32 byte key) and compared in constant time, and the API never returns it afterwards, so the sender is the only one who can repeat it. Five failed attempts lock the recipient for 15 minutes. A one time code is 6 digits, expires after 10 minutes and can be redeemed once, and no more than 5 codes can be requested for one recipient in any 10 minute window, so a resend loop cannot flood an inbox. Those two throttles are the whole defence against guessing, which is why the lockout matters more than the length.
Choosing by what is at stake
For an ordinary commercial agreement between parties who already know each other, the emailed code is usually right: it costs nothing and defeats the most common problem, a forwarded link. Reach for an access code when the email address itself is shared, such as an accounts inbox, or when the document is valuable enough that you want a second channel involved. For anything higher, neither is enough, and this product offers no stronger method: the three choices are an email link only, an access code or an emailed one time code.
Questions people ask
How long should a one time code last?
Minutes rather than hours. Ten minutes is a common setting and it is long enough for somebody to switch to their inbox and back without being long enough for a code sitting in a shared mailbox to be useful later. Codes should also be single use, so replaying one from an earlier session fails.
How many digits should a code be?
Six is the usual answer and it is enough when it is paired with a lockout. The strength comes from limiting attempts, not from length: six digits is a million combinations, which is trivial to brute force without a lockout and effectively impossible with one that stops after a handful of failures.
Can I use both on the same signer?
No. Each recipient carries exactly one of three methods: email link only, access code, or emailed one time code. If you want two channels involved, the access code already gives you that, because the code travels by phone or in person while the link travels by email. Stacking two codes to the same person mostly tests their patience.
What happens if a signer never receives the code?
They ask for another, and the system should cap how many are issued in a window so that a resend loop cannot be used to flood an inbox. Persistent failures usually mean a filter caught the message, at which point the fix is an access code you read out over the phone.
Do these codes make a signature legally stronger?
They strengthen the evidence, not the legal category. The statutes do not require any particular check, but if the signature is ever disputed, the difference between a bare link and a recorded identity check with a lockout behind it is exactly the kind of thing that decides whether the record is believed.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is an audit trail in e-signature?What is an audit trail in e-signature? The time ordered record of when a document was sent, who opened it, how signers were verified and who signed.
- Is an electronic signature legally binding?In most countries yes: a signature cannot be denied effect merely because it is electronic. What the statutes require, and the documents still excluded.
- What is signing order?Signing order sends the document to one person at a time, in sequence. When sequential signing matters and when it just slows everything down.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .