IPHONE
How OTP AutoFill Works on iPhone
Use iPhone verification-code AutoFill safely and troubleshoot codes that do not appear above the keyboard.
iPhone can detect verification codes in Messages and Mail and suggest them above the keyboard. AutoFill saves typing, but it does not change how the OTP is delivered or whether it is valid. Always confirm that the code belongs to the service and action currently on screen.
Using AutoFill
Keep the verification field focused when the message arrives. If iOS recognises the code, a suggestion appears above the keyboard; tap it once to enter the digits. The website or app must mark its field appropriately, so some services will still require manual entry. Never paste a code into a page opened from an unexpected message.
When the suggestion is missing
Open Messages or Mail and confirm the code actually arrived. Return to the app and tap the code field again. Make sure the code is in a clear numeric format and that the requesting app is current. Restart the app if the field is unresponsive. You can always type the latest valid code manually.
Use the correct code
Multiple requests may create several messages. Check the timestamp and use only the newest code for the active login session. AutoFill may show a recently received code that belongs to another service, so read the sender and message text before accepting the suggestion.
Protect codes on iPhone
Use Face ID or Touch ID with a strong device passcode and limit notification previews on the lock screen. Keep iOS updated. If the iPhone is lost, mark it lost through Find My and protect the Apple Account and primary email before recovering other accounts.
Quick checklist
- Focus the verification field
- Confirm sender and action
- Use the newest code
- Type manually if needed
- Hide sensitive notification previews
Frequently asked questions
Does AutoFill send my code to another company?
AutoFill enters the detected code into the field you selected; review the app or site before tapping.
Why did an old code appear?
A recent message may still be suggested. Verify the timestamp and active session.