Why a 4-digit code and not a link
2026-09-24
This post contains affiliate links. As an Amazon Associate, ZAGO.TO earns from qualifying purchases.
Almost every tool that moves text between devices hands you a link. You paste your text, you get a URL, you send the URL somewhere, the other side clicks it. SyncClip, Qtext, coppy.it, CopyPaste.me, PrivateNote and a dozen others all work roughly this way. Some give you a QR code instead, which is the same idea in a different shape.
We give you four digits. `3342`. That is the whole thing.
This was a deliberate choice and it costs us something, so it is worth explaining what we bought with it.
A link cannot be said out loud
Try reading a URL to someone on the phone. Not a short one like example.com, but the kind these tools generate: a domain, a slash, and eight or ten random characters.
You will spend the next minute saying things like "lowercase L, then the number one, no, the other one" and then starting over. Capital I and lowercase l look identical in most fonts. Zero and capital O are the same problem. Random strings are built out of exactly the characters that sound alike.
Four digits do not have this problem. There is no ambiguous digit. You say them the way you say a phone number, the other person repeats them back, and you are done in three seconds.
That sounds like a small thing until you notice how often the situation comes up.
The situations where speech is the only channel
Here is the list, and none of these are unusual.
You are already on the phone with someone. They need an address, a booking reference, a paragraph you wrote. Stopping the call to find an app you both have, then typing the message, then going back to the call, is a worse experience than just saying four numbers.
You are standing next to them. At a desk, in a shop, at a help counter. There is no need for any channel at all. You say it, they type it.
You are on a call and they are in front of a computer that is not theirs. A support agent, a colleague at a shared terminal, a relative at a library. They cannot install anything and should not log into anything.
You want to write it somewhere physical. A whiteboard in a classroom. A sticky note on a monitor. The margin of a printed page. A URL on a whiteboard gets mistyped by half the room. Four digits do not.
You are texting, and you do not want the content in the text. This one is subtle. If you send a link, the content sits behind that link, and the link sits in the message thread indefinitely. If you send four digits, the digits mean nothing a minute later.
A link is a good design when the receiver is going to tap it. It is a bad design the moment a human voice or a human hand has to carry it.
Why not six digits
Six digits is the obvious middle ground, and at least one similar service uses exactly that. It gives you a million codes instead of ten thousand, which makes guessing far harder, and it is still only digits so it still survives being spoken.
We tried it and dropped it. Six is past the point where a number stays in your head on the way from one device to the other. Four is a chunk. Six is two chunks, and people reliably transpose the middle pair when they repeat it back. Phone numbers are grouped for exactly this reason.
So the question became whether to buy safety with digits or with time. We bought it with time. A four-digit code that expires in a minute is harder to guess in practice than a longer one that sits around for an hour, and it is much easier to say.
What four digits cost us
Now the honest part, because this trade is not free.
Four digits is a small space. There are ten thousand of them. If every code were in use at the same moment, we would have nothing left to hand out. In practice this is fine, because a code only exists for about a minute and then it is gone, so the number of live codes at any moment is tiny. But we do have a fallback: when every 4-digit code happens to be taken, the next one issued is 5 digits. We would rather hand you a longer code than make you wait.
A short code is guessable in a way a long link is not. Someone typing random four-digit numbers will eventually land on a live one. This is a real weakness and we deal with it in three ways. Codes live for about a minute, so the window is narrow. Wrong guesses are rate limited per address, ten failed attempts in ten minutes and you are blocked. And you can put a 4-digit PIN on a message, which locks the code after three wrong tries.
That third one is the important one. If you are moving something you would not want a stranger to stumble onto, put a PIN on it. The code gets you to the door, the PIN opens it.
You cannot just tap it. With a link, the receiver taps and the text appears. With us, they have to open the site and type four digits. That is two or three seconds of friction we are deliberately keeping, and for some uses a link genuinely is better.
When you should use something else
We would rather say this plainly than pretend we fit everywhere.
If the receiver is going to tap on a screen anyway, a link is less work. If you need the text to still be there tomorrow, we are the wrong tool, because it will be gone. If you need to send a file, we do not move files at all, only text. If you are moving something that must never be readable by anyone but the two of you, note that there is no browser-side scrambling here today, so our server can read what passes through.
None of the link-based tools listed at the top are bad. They are solving a slightly different problem, and several of them solve it well.
The shape of the choice
Most products in this category optimise for the receiver's thumb. We optimised for the sender's voice.
That is the entire difference, and it decides everything else about the design. Four digits instead of a URL. No account, because an account would need a login the other person does not have. One minute, because a code you said out loud is a code you cannot un-say, and the only real protection for a spoken secret is that it stops meaning anything quickly.
If you have never needed to read something aloud to another person, you will not miss any of this and you should use whichever tool has the nicest button. If you have, you already know which part was the annoying part.