I have witnessed that a company can send you a PIN code by SMS (not by any other app or iMessage) and be able to delete it afterwards, like 24 hours.

Is it specific to the network provider like sending a specific #xxx# code at the beginning of the text message or is it specific to iOS?

1 Answer 1


This is purely implemented on the iOS side on iOS 17 and the #12345678 has to be the last line of the SMS. All the Freeform text should come before the code. Also, nothing is deleted after 24 hours. The SMS containing such codes is deleted immediately if the user taps to use it - and it sits in the deleted messages filter for another 40 days or so.


  • Open Settings on your ‌iPhone‌ or ‌iPad‌.
  • Scroll and tap Passwords (you'll be prompted to authenticate the next screen).
  • Tap Password Options.

Look under "Verification Codes," toggle on the switch next to Clean Up Automatically so that it is in the green ON position. As long as you send an SMS that matches the pattern matching that Apple employs, people will be able to take advantage of the auto fill capabilities, but the auto delete action hinges on someone "filling" in the field when prompted.


On the sender side, here are Apple guidance on proper format for sending SMS:

Here’s what the text should looks like:

123456 is your Example code.  

@example.com #123456

Everything above the last line of the message is freeform. You're free to customize this part however you like, but it should be something that makes sense to people receiving the code. The last line of this message gives AutoFill on iPhone, iPad, or Mac the information it needs to bind the domain and code together and suggest the code for the appropriate website or app. In order for domain-bound codes to work properly, you must include this information in the last line of the message, and it must contain the domain and code in the correct order.

This is the first part of that last line, and contains the domain of the app or website where you want the code to fill in. Make sure to put a single space after your domain before you begin the segment with your one-time code.

#123456 (represents the code 123456)
The second part of the last line begins with # and contains the string with your app or website’s one-time code.

  • This has saved me literally minutes a week swiping & tapping. 😇
    – IconDaemon
    Commented Feb 4 at 18:41
  • My question was more about, what’s the coding behind it ? What does need to be in the text to be recognized as such and so deleted after 24 hours. (Since that’s what happened with some banks OTP text for example even if the code are not used on that phone specifically but on the computer for example)
    – vigilian
    Commented Feb 5 at 10:21
  • See my edit @vigilian on the iOS side Apple likely implemented a private API like the public ones for other data detectors. developer.apple.com/documentation/datadetection but the SMS part is very trivial to compose and they announced it in a short press release on 2020
    – bmike
    Commented Feb 5 at 12:37
  • Also, where do you get this 24 hour delete? That has nothing to do with this feature. The “deletion” is immediate when someone taps to use the code, and not on a timer.
    – bmike
    Commented Feb 5 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .