Use Generate Secure Code to create a code, PIN, OTP, invite code, or access code.
Set the code length, choose which character types to include, and provide an Expires At date. For example, set Expires At to Current date/time +(10):minutes for a 10-minute code.

For extra security, you can include Purpose and User Identifier in the hash. Purpose can be login, password reset, invite, email verification, admin access, or any label you choose. User Identifier can be an email, username, phone number, or user ID.

You do not need to save the plain code in your database. Save the Code Hash, Expires At, Attempt Count, Already Used value, Purpose, User Identifier, and hash settings. Send only the plain Code to the user by email, SMS, or another messaging service.

Use Verify Secure Code when the user submits their code.

Pass in the Submitted Code from the user's input, the Saved Code Hash from your database, Expires At, Attempt Count, Max Attempts, Already Used value, and the same Purpose, User Identifier, and hash settings used when generating the code. The plugin hashes the submitted code with the same security settings and compares it to the saved hash.

If Is Valid is yes, continue the login, verification, invite, reset, or access workflow. After a successful verification, mark the code as used in your database.

If Should Increment Attempts is yes, increase the saved Attempt Count by 1.

Use Hash Input when you want to hash any custom value, not just generated codes. This is useful for securely storing identifiers, access tokens, invite keys, lookup values, or other sensitive text without saving the original input.

Use Verify Hash Input when you want to compare a submitted value against a saved hash. Pass in the submitted input, saved hash, and the same Purpose, User Identifier, and hash settings used when the hash was created.

Common status values:
valid = code is correct and can be accepted
incorrect = code is wrong
expired = code is past the Expires At date
locked = too many failed attempts
already used = code was already used successfully
missing code = no submitted code was provided
missing saved hash = no saved hash was provided
missing expiration = no valid Expires At date was provided