Guides / Old one-time codes

Are old one-time codes in screenshots dangerous?

Updated 3 November 2026 · By the FirstHour team

Short answerUsually not. A code made for one login should be useless once it has been used, so you can generally delete the screenshot. Two things matter more: a code you haven't used yet, and the rest of the message, which can show which accounts use your number. Backup codes are different. Those stay valid until you use them or make a new set.

What a one-time code is

A verification code is sent by text or email when you log in, to confirm it's really you. It's one form of two-factor authentication. That's the Federal Trade Commission's description. Since it's made for one login, an old one that has been used shouldn't open anything. That part is our reading of how these codes are meant to work.

What can still go wrong

What to do

  1. Never share a code you've just received. If someone asks for one, end the contact, block them and report it to the FTC at ReportFraud.ftc.gov in the US, or to your national fraud-reporting service elsewhere, as the FTC advises. If you're worried about an account, contact your bank using a number from its app or your statement, not the one the caller gave you.
  2. Delete old code screenshots. Deleted photos stay in Recently Deleted for 30 days, and with iCloud Photos on, a deletion applies to all your devices. Empty Recently Deleted to remove them sooner.
  3. Keep new ones from piling up. Apple says that on iOS 17 or later, you can go to Settings, then General, then Autofill & Passwords, and turn on Delete After Use. Then codes in Messages or Mail are deleted after you use them with AutoFill.
  4. Hide them on the Lock Screen, if you'd rather no one saw them there. Here's how.

If you sent a code to someone

Keep the messages until you've reported it.

If you gave a code to a person who then used it, treat that account as open to them. The FTC says to create a new strong password if you can still log in, change it anywhere else you used it, and turn on two-factor authentication. If your bank is involved, contact it right away using a number you trust. You can't undo what was done with a code, but you can shut the door.

How FirstHour helps

Protect looks through your pictures on your iPhone for short codes that sit next to words like "verification code" or "OTP", and shows them in their own group called Old one-time codes. It keeps these apart from backup codes so you can see which ones matter. Since they're usually safe to delete, that group offers a Delete all button even while its pictures are blurred. Glance at the pictures first: the group guesses from words, not from what the code was. Nothing is uploaded.

It reads the words and numbers in the picture, not whether a code still works, so check the date of a screenshot before you decide. It can miss codes in blurry pictures or handwriting, and it doesn't check videos or your Hidden album. It can't read codes that stay in your Messages app. Only pictures in Photos are checked.

Questions

Can I keep codes in the Passwords app?

Apple says the Passwords app keeps verification codes alongside your passwords, so that's a safer place than a picture for codes you need to keep.

Should I delete a code screenshot I sent to a friend?

Delete yours. If the code was used, it should be harmless. If it wasn't, ask why they needed it, and be careful.

Sources

All guides