The Math of Words: Comparing Entropy in Word-Pair Auth vs. Numeric OTPs

The Entropy Equation

Entropy, in authentication, is the number of possible secrets an attacker must guess.

The Status Quo: 6-Digit PINs

• Base: 10
• Length: 6
• Combinations: 10^6 = 1,000,000

Blind guess probability is 1 in 1,000,000.

The WordAuth Alternative: 2-Word Pairs

WordAuth uses a curated library of 1,000 adjectives and 1,000 nouns selected for phonetic distinctness and cultural neutrality.

• Pool A (Adjectives): 1,000
• Pool B (Nouns): 1,000
• Combinations: 1,000 * 1,000 = 1,000,000

Result: The entropy of a code like Swift Tiger is mathematically identical to a 6-digit OTP.

Collision Resistance and Expiry

Combination count is only one piece of security. Lifecycle controls matter just as much.

1. Strict rate limiting with exponential backoff on verification attempts.
2. Short-lived TTL (default 5 minutes, configurable via API).
3. Single-use semantics: verified or expired codes are purged from active cache.

From Complexity to a Single Endpoint

Traditional OTP infrastructure requires state, template handling, delivery providers, and verification logic. WordAuth reduces this to a single API workflow.

The Old Way (Conceptual)

// Managing state, DB entries, and SMS providers manually
const code = generateRandomSixDigits();
await db.otp.create({ userId, code, expiresAt: Date.now() + 300000 });
await smsProvider.send({ to: userPhone, body: `Your code is ${code}` });

The WordAuth Way

import { WordAuth } from "wordauth";

const wa = new WordAuth(process.env.WORDAUTH_API_KEY);

// Generate and send a word-pair code via SMS
const response = await wa.codes.sendSms({
  phoneNumber: "+1555010999",
  expiresIn: "5m",
});

console.log(response.status); // "sent"

Verification is a single call with user input.

const verification = await wa.codes.verify({
  code: "Swift Tiger",
  userId: "user_123",
});

if (verification.valid) {
  // Proceed with login
}

Why Complexity Is Not Security

We often mistake "unfriendly" for "secure." A 6-digit numeric code is harder for humans to remember, but no harder for computers to brute-force than a two-word phrase with equal search space. You are not trading away entropy. You are reducing user error while preserving security.