Testing SMS verification and 2FA with real US numbers

Most SMS providers offer test credentials or special test numbers that report success without sending a message. That’s right for unit tests, but it skips everything that happens after your provider: US carrier filtering, your sender registration status (10DLC or toll-free), and how the message actually looks on a phone.

Message encoding is a common surprise. A plain-text SMS segment holds 160 characters, but a single emoji or curly quote switches the message to Unicode, which holds only 70, so one message can become two or three segments.

• Delivery time from request to arrival, over several attempts and at different times of day.
• The message text: your brand name, the code near the start, and nothing that looks like spam.
• Code length, expiry, and what happens with an expired or already used code.
• The resend button: cooldown, rate limits, and which code is valid after a resend.
• Autofill: iOS suggests codes from the message automatically, the WebOTP format puts @your-domain #123456 on the last line, and Android’s SMS Retriever needs your 11-character app hash in the message.
• Number formats: your form should accept +1, spaces, dashes and brackets.
• Recycled numbers: US carriers reassign numbers, so check what your app does when a new user’s number is already linked to an old account.

Your own app won’t be in the list, so search for it and choose Service not listed. Each one-time number costs from $0.70 and is refunded if no message arrives within 5 minutes, which also makes failed deliveries easy to spot.

For longer test runs, rent an “Any app” number for 1, 7 or 30 days. It receives every text sent to it, so you can test resends, login codes and 2FA on the same number. Link Telegram to get each message on your phone while you test.

Use test numbers for products you own or are authorized to test. Creating accounts in bulk, getting around another service’s limits or bans, and spam aren’t allowed. See the acceptable use policy.