Email Verification Codes Are a Lie. A High Schooler Just Proved It.

You know the ritual. You try to log in somewhere. The site says: “We sent a code to your email.” You open your email. You see a six-digit number. You memorize it for exactly three seconds. You switch back. You type it in. You feel nothing. You do this fourteen times a day.

Now a high schooler in Canada has built a Mac app called OpenOTP that autofills those codes for you — no copy-paste, no tab-switching, no three-second amnesia. And in doing so, Jenin (the developer, who is literally still in high school) has accidentally exposed something the entire tech industry would rather you not think about.

Email verification codes aren’t a security feature. They’re a security theater performance — and we’re all unpaid actors.

Think about it. The entire premise of an email OTP is that only you can access your inbox. But if that’s true, why do you need a code at all? The email itself is the proof. The six-digit number is just a speed bump — a ritual that makes you feel like something secure is happening, when really you’re just proving you can read a message that was already sent to you.

And here’s the uncomfortable part: OpenOTP makes this absurdity impossible to ignore. By automating the autofill, it strips away the illusion of deliberate action. You’re no longer “confirming your identity.” You’re just… logging in. Which is what you were doing anyway.

The security industry will tell you this is dangerous. They’ll say that requiring explicit user action — the manual copy, the manual paste — is a critical safeguard against phishing and device compromise. And they’re not entirely wrong. If your Mac is infected, an automated tool that reads your email and fills in codes is a gift to attackers.

But that argument reveals the real problem: if your device is compromised, your email-based OTP was already worthless. The attacker can read your email too.

The manual copy-paste was never protecting you from a compromised device. It was protecting you from feeling like you weren’t protected. It was friction dressed up as security — a little ceremony to make the lack of real authentication feel intentional.

This is what makes OpenOTP more than a convenience tool. It’s a mirror. It shows you that the thing you’ve been doing — the tab-switching, the number-memorizing, the three-second window where you hold “482910” in your head like it matters — was never the point. The point was that email became the de facto identity layer of the internet, and nobody ever stopped to ask if that was a good idea.

Because it wasn’t. Email was designed for communication, not authentication. It was never built to be the universal proof of identity. It just… happened. Every service needed a way to verify you, email was already there, and nobody wanted to build something better. So we got six-digit codes sent to an insecure channel, and we called it two-factor authentication, and we patted ourselves on the back.

The real two-factor authentication we need isn’t a code sent to your inbox. It’s the courage to admit that email was never supposed to hold this much weight.

OpenOTP is a small app built by a high schooler. It saves you a few seconds per login. It’s not going to change the world. But it should make you uncomfortable in a way that matters — because the moment you stop manually copying that code, you’re forced to confront what the code was actually doing.

Nothing. It was doing nothing that your email inbox wasn’t already doing.

The future of authentication isn’t faster OTP autofill. It’s killing the OTP entirely — moving to passkeys, hardware tokens, and systems that don’t rely on a 1970s messaging protocol to prove you are who you say you are. OpenOTP isn’t the destination. It’s the signpost that says: you’ve been walking in the wrong direction this whole time.

So yes, install it. Enjoy the convenience. But remember what it cost you to get that convenience: the last shred of illusion that email verification was anything more than a checkbox the internet never should have built its identity on.