One-Time Passcode (2FA) Email delivers a short code for two-factor sign-in, approving a payment, confirming a withdrawal or changing an email address. It has one job: get the right digits in front of the right person quickly, and make it as hard as possible for anyone to talk them out of it.

Each digit in its own box

The code is shown character by character in separate boxes, set in a monospace font so a zero never looks like an O, with a small gap in the middle of six- and eight-digit codes, the way people read them aloud ("739 204"). On phones the boxes shrink so up to eight characters still fit on one line. If you put a merge variable such as {{ code }} in the field, it is kept whole in one box instead.

Purpose first, and in the subject

A pill above the headline says what the code is for, such as "Sign-in verification" or "Approve payment". The sample subject starts with the code itself ("739 204 is your Ledgerly verification code"), which lets people read it straight from the notification and lets iOS and Android suggest it as a one-tap autofill.

Short expiry and a clear warning

A line under the code states how long it lasts and that it works once. An amber box then says, in bold, that your company will never ask for the code by phone, chat or email, which targets the most common way 2FA codes are stolen: a scammer pretending to be support.

Where the request came from

An optional details box lists the device, approximate location, IP address and time, so a person who did not ask for a code knows something is wrong. A "Wasn't you? Secure your account" link sits below. There is no button to click for the code itself, deliberately.

Send it from your auth provider or code (Auth0, Clerk, Supabase, Firebase, Cognito or a custom flow) through a fast transactional sender. For link-based sign-in use Magic Link, and for account confirmation after sign-up use Verify Email.