E-signatures · Compared
Access code against one time code
An access code is a secret you set on a recipient and pass to them yourself, by phone or in person, before they sign. A one time code is generated when they try to sign, emailed to the address on the envelope, and expires within minutes. The first proves they know something; the second proves they control that inbox.
Both sit between sending a bare link and asking for photo identification. Choosing between them is a question about what you are actually worried about.
Nuwan Madhusanka · Co-founder
3 min read · Published
| Access code | One time code | |
|---|---|---|
| What it proves | The signer knows a secret you gave them | The signer can read the invited inbox |
| How it reaches them | You send it out of band, by phone or in person | Emailed automatically at signing time |
| Lifetime | Lasts until you change it | Expires in minutes, single use |
| Weak against | Forwarding the code with the link | Anyone who already has the inbox |
| Effort for you | You must contact each signer separately | None |
What each one is really testing
A one time code sent to the invited address tests control of that inbox and nothing more. If the link and the inbox are both compromised, the code arrives at the attacker. An access code tests knowledge of something that never travelled with the link, which is why it is stronger against an intercepted email and weaker against a signer who simply forwards both to a colleague. Neither proves who the person is; they raise the cost of pretending.
How they are stored and rate limited
A sensible implementation never stores an access code in plain text. Hashing it with a memory hard function, salted per recipient, and comparing in constant time is the baseline, and the code is never returned by the API afterwards, so the sender is the only one who can repeat it. Both checks need lockout: a small number of failures should lock the recipient for a period, and one time codes need a cap on how many can be requested in a window, or the email becomes the attack.
Choosing by what is at stake
For an ordinary commercial agreement between parties who already know each other, the emailed code is usually right: it costs nothing and defeats the most common problem, a forwarded link. Reach for an access code when the email address itself is shared, such as an accounts inbox, or when the document is valuable enough that you want a second channel involved. For anything higher, neither is enough and you want identity verification against a document.
Questions people ask
How long should a one time code last?
Minutes rather than hours. Ten minutes is a common setting and it is long enough for somebody to switch to their inbox and back without being long enough for a code sitting in a shared mailbox to be useful later. Codes should also be single use, so replaying one from an earlier session fails.
How many digits should a code be?
Six is the usual answer and it is enough when it is paired with a lockout. The strength comes from limiting attempts, not from length: six digits is a million combinations, which is trivial to brute force without a lockout and effectively impossible with one that stops after a handful of failures.
Can I use both on the same signer?
Typically no; a recipient carries one identity method. If you genuinely need two factors, the stronger pattern is an access code plus a document based identity check rather than two codes, since two codes to the same person mostly tests their patience.
What happens if a signer never receives the code?
They ask for another, and the system should cap how many are issued in a window so that a resend loop cannot be used to flood an inbox. Persistent failures usually mean a filter caught the message, at which point the fix is an access code you read out over the phone.
Do these codes make a signature legally stronger?
They strengthen the evidence, not the legal category. The statutes do not require any particular check, but if the signature is ever disputed, the difference between a bare link and a recorded, rate limited identity check is exactly the kind of thing that decides whether the record is believed.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is an audit trail?An audit trail is the ordered, tamper evident record of everything that happened to a document: who opened it, who was challenged, who signed and when.
- Is an electronic signature legally binding?In most countries yes: a signature cannot be denied effect merely because it is electronic. What the statutes require, and the documents still excluded.
- What is signing order?Signing order sends the document to one person at a time, in sequence. When sequential signing matters and when it just slows everything down.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .