One-time passcodes are the cheapest way to make sure a form response belongs to a real person with a real inbox. They are also the fastest way to lose a third of your respondents if you turn them on without thinking. This guide is about the thinking.

When a code is worth it

Ask for verification when the response has value to the respondent, not just to you. Applications, registrations, anything that produces an account or a ticket: people expect a code there and will type it. Feedback forms, NPS surveys and quick polls are the opposite. The respondent is doing you a favour, and a code is one more reason to close the tab.

A useful rule: if you would be annoyed to get a duplicate, verify. If you would be annoyed to get one fewer, do not.

What it does to completion

Across forms that switched OTP on this year, the median drop in completed responses was 11 percent. That number hides a wide range. Forms where the code arrived within ten seconds lost almost nothing. Forms where the sending domain was new, or where the email landed in a promotions tab, lost closer to a quarter.

  • Send from a domain you already use for transactional mail.
  • Keep the code email plain: subject line, code, nothing else.
  • Show the code field on the same page as the email field, so the respondent never loses their place.

Filtering rules that belong next to OTP

Verification tells you the address is real. It does not tell you it is the right kind of address. Three rules pair well with it:

  • Block disposable domains. OnlyForm keeps the list current so you do not have to.
  • Require a company domain for B2B forms, with an allow-list for the customers who use consumer email.
  • Rate-limit by address so a single inbox cannot submit the same form fifty times.
Verification is a filter, not a wall. The goal is to keep the responses you want, not to prove a point to the ones you do not.

Turning it on

In the form settings, open Access and choose "Verify email". Pick the code length, decide whether to remember verified respondents for the session, and test it on yourself before publishing. The template gallery has a verified version of every public form if you would rather start from one.