Extract OTP, verification, security, 2FA, and MFA codes from Arabic or English SMS and email text. This tiny, dependency-free JavaScript OTP parser detects 4–8 digit codes and alphanumeric codes, normalizes Arabic-Indic numerals, and avoids common false positives such as phone numbers and dates.
JavaScript · Node.js · TypeScript types · Arabic + English · Zero dependencies
import { extractOTP } from 'otp-message-extractor';
extractOTP('Your verification code is 582914');
// { code: '582914', confidence: 0.98 }A basic OTP regex often returns the first number it sees. Real SMS messages may also contain a phone number, date, year, transaction reference, or more than one number. OTP Message Extractor ranks candidates using nearby phrases such as verification code, security code, OTP, رمز التحقق, and كود التأكيد, then returns the strongest match with a confidence score.
- Extracts numeric OTP codes containing 4 to 8 digits.
- Detects mixed alphanumeric verification codes such as
A8D-291. - Parses Arabic and English SMS, notification, and email-body text.
- Converts Arabic-Indic
٠١٢٣٤٥٦٧٨٩and Eastern Arabic-Indic۰۱۲۳۴۵۶۷۸۹digits to0-9. - Filters common phone-number and structured-date formats.
- Returns a deterministic confidence score for the best candidate.
- Includes TypeScript declarations.
- Has zero runtime dependencies and performs no network requests.
npm install otp-message-extractorNode.js 18 or newer is required.
import extractOTP from 'otp-message-extractor';
extractOTP('Your verification code is 582914');
// { code: '582914', confidence: 0.98 }extractOTP('رمز التحقق الخاص بك هو ٥٨٢٩١٤');
// { code: '582914', confidence: 0.98 }extractOTP('Your verification code is A8D-291');
// { code: 'A8D-291', confidence: 0.96 }extractOTP('Call +20 10 1234 5678');
// null
extractOTP('The appointment date is 2026-08-03');
// nullconst message =
'Call +20 10 1234 5678 before 03/08/2026. Your code is 739201.';
extractOTP(message);
// { code: '739201', confidence: 0.95 }| Message or code type | Example | Result |
|---|---|---|
| 4-digit PIN | OTP: 4821 |
4821 |
| 6-digit verification code | Your code is 582914 |
582914 |
| 8-digit security code | Security code: 12345678 |
12345678 |
| Arabic-Indic digits | رمز التحقق ٥٨٢٩١٤ |
582914 |
| Eastern Arabic-Indic digits | کد تایید ۱۲۳۴۵۶ |
123456 |
| Alphanumeric code | Code: A8D-291 |
A8D-291 |
| Structured date | Date: 03/08/2026 |
null |
| Phone number | Phone: +20 10 1234 5678 |
null |
Accepts a string and returns the most likely OTP candidate or null.
interface OTPResult {
code: string;
confidence: number;
}
declare function extractOTP(message: string): OTPResult | null;Arabic-Indic digits are normalized in code. confidence is a deterministic heuristic score from 0 to 0.99; it is not a statistical probability. The function throws a TypeError when the input is not a string.
- SMS OTP extraction in Node.js authentication services.
- Verification-code parsing in an SMS inbox or support dashboard.
- 2FA/MFA passcode highlighting and copy buttons.
- Parsing codes from email bodies or notification text.
- Authorized QA and end-to-end tests for sign-in and payment flows.
- Virtual-number and temporary-number inbox interfaces.
- Receive-SMS services that need to identify the likely code inside a message.
This package provides the message-parsing layer needed to build OTP highlighting or one-click copy experiences in virtual-number, temporary-number, and online SMS inbox products. It can power a similar code extraction experience to the one users expect from receive-SMS websites such as Receive SMS Live: pass the received message text to extractOTP() and display the returned code.
This project is independent and is not affiliated with, endorsed by, or connected to Receive SMS Live. It does not provide phone numbers, receive or fetch messages, access that website, or bypass account verification. Use it only with messages and systems you own or are authorized to process. Public/shared phone numbers should never be used for sensitive, financial, or personal accounts.
This package parses a message string you already have. It solves a different problem from:
- WebOTP API: asks a supported browser, with user consent, to obtain a specially formatted SMS and fill a verification form.
- TOTP/HOTP libraries: generate or verify time-based or counter-based one-time passwords using a secret.
- SMS receiver libraries: read messages from a device or connect to an SMS provider.
You can use this parser after your own authorized SMS provider, inbox, webhook, email service, or test harness supplies the message text.
- Normalizes Arabic-Indic digits without changing message offsets.
- Marks common date and phone-number ranges as protected.
- Finds numeric and alphanumeric OTP candidates.
- Scores each candidate using OTP keywords, distance, format, and negative context.
- Returns the highest-scoring candidate above the minimum confidence threshold.
The implementation is deterministic: the same input always produces the same output.
Pass the SMS body to extractOTP(message). The function returns { code, confidence } or null when no strong candidate is found.
Yes. Numeric codes from 4 to 8 digits are supported, with 6-digit codes receiving a slightly stronger format score because they are common in verification messages.
Yes. Arabic phrases and both Arabic-Indic numeral sets are supported. Returned digits are normalized to 0-9 for easier form filling and API use.
Yes. Pass the email subject or plain-text body as a string. This package does not download or convert HTML email by itself.
No. It only analyzes the string supplied by your application. Use an authorized device API, SMS provider, webhook, or inbox integration to obtain the text first.
No. It extracts a code displayed in text; it does not generate secrets or cryptographically validate a code.
No. It is a transparent heuristic ranking score intended to help compare candidates inside the same message.
OTP Message Extractor مكتبة JavaScript خفيفة ومن دون اعتماديات، مخصّصة لاستخراج رمز التحقق أو كود التأكيد من نصوص رسائل SMS والإشعارات والبريد الإلكتروني باللغة العربية أو الإنجليزية.
import { extractOTP } from 'otp-message-extractor';
extractOTP('كود التأكيد الخاص بك هو ٤٨٢١');
// { code: '4821', confidence: 0.93 }- استخراج كود OTP رقمي من 4 إلى 8 أرقام.
- قراءة الأرقام العربية مثل
٥٨٢٩١٤وإرجاعها بالشكل582914. - استخراج الأكواد المختلطة من حروف وأرقام مثل
A8D-291. - تجاهل أرقام الهاتف والتواريخ المكتوبة بالصيغ الشائعة.
- اختيار الكود الأقرب لعبارات مثل «رمز التحقق»، «كود التأكيد»، «رمز الدخول»، و«كلمة المرور لمرة واحدة».
- العمل محليًا من دون إرسال الرسالة أو الكود إلى أي خدمة خارجية.
يمكن استخدام المكتبة لبناء طبقة تحليل الرسائل وإبراز كود التحقق داخل واجهات صناديق SMS أو مواقع الأرقام الافتراضية والمؤقتة، بما يشبه تجربة استخراج ونسخ الكود التي يتوقعها المستخدم في مواقع مثل Receive SMS Live. المشروع مستقل تمامًا ولا يتبع الموقع المذكور ولا يستقبل الرسائل أو يوفر أرقامًا مؤقتة بنفسه.
استخدم المكتبة فقط مع الأنظمة والرسائل التي تملكها أو لديك تصريح لمعالجتها، ولا تستخدم الأرقام العامة أو المشتركة للحسابات الحساسة أو البنكية أو الشخصية.
- Do not log message bodies or extracted OTPs in production.
- Process only messages you are authorized to access.
- Treat OTPs as secrets and discard them as soon as the verification flow finishes.
- This package runs locally and makes no network requests.
- See SECURITY.md for vulnerability reporting.
npm test
npm run checkBug reports, real-world format descriptions, and pull requests are welcome. Never publish a real phone number, OTP, or private message in an issue. Use invented examples and add a test for every new format or false-positive fix. See CONTRIBUTING.md.