Google Messages OTP Auto-Deletion: How It Works
Google Messages now offers automatic one-time password (OTP) auto-deletion, a feature that removes verification codes from your conversation thread after a set period. You can enable it in the app’s settings, and it works by detecting OTPs in incoming messages and deleting them after 24 hours by default. This article explains exactly how the feature works, how to turn it on, what limits it has, and answers common questions about it.
What Is OTP Auto-Deletion in Google Messages?
OTP auto-deletion is a privacy and security feature built into the Google Messages app (the default SMS/RCS app on most Android phones). When enabled, the app automatically identifies messages that contain a one-time passcode—like the 6-digit code you receive from your bank or a login confirmation—and deletes them from the conversation after a chosen time period. The default is 24 hours, but you can choose 1 hour, 1 day, or 1 week.
The feature is designed to reduce the risk of someone reading your old verification codes if they get access to your phone. It also helps keep your inbox tidy, since those codes are usually useless after a short time anyway.
Background: Why OTPs Are a Security Risk
One-time passwords are used for two-factor authentication (2FA) across thousands of services—from Google and Facebook to your bank and email provider. They’re sent via SMS because nearly every phone can receive them, but SMS is not the most secure channel. If someone steals your phone, or if you lose it, all those stored codes are sitting right in your text messages. Even if you don’t lose your phone, a malicious app with SMS permissions could read them.
Auto-deletion is a simple mitigation: it removes the codes after they’ve served their purpose, so they’re not lying around in your message history. It’s not a silver bullet—if someone has access to your phone at the exact moment the code arrives, they can still use it—but it reduces the window of exposure.
How to Enable OTP Auto-Deletion
Turning on the feature takes just a few taps. Here are the steps for the current version of Google Messages (as of 2025):
- Open the Google Messages app on your Android phone.
- Tap your profile picture (top-right corner) to open the menu.
- Select Messages settings.
- Tap General (or Message organization depending on your version).
- Look for Auto-delete OTPs and toggle it on.
- Choose the deletion period: 1 hour, 1 day (default), or 1 week.
If you don’t see the option, make sure your app is updated to the latest version. The feature rolled out gradually, so it may not be available on all devices immediately. Also, it only works for messages that Google’s algorithm identifies as OTPs—it won’t delete a random message that happens to contain a 6-digit number.
How the Detection Works (and Its Limitations)
Google Messages uses on-device machine learning to recognize OTP patterns. It looks for common formats: a short numeric code (usually 4–8 digits) sent by a known service (like your bank or a delivery app). It also checks the context—words like “code,� “OTP,� “verification,� or “expires� often accompany the number.
But it’s not perfect. Here are some real limitations:
- False positives: A friend might text you “Hey, my new number is 123456� and the app could delete it. You can restore deleted messages within a short window (see below).
- False negatives: If a service sends the code in an unusual format (e.g., “Your code is X9K2� instead of a pure number), the app might not recognize it and won’t delete it.
- RCS vs SMS: The feature works for both SMS and RCS messages, but only if the message is delivered to the Messages app. If you use a third-party SMS app, it won’t apply.
Also, auto-deletion only applies to messages received after you enable the feature. It won’t retroactively delete OTPs that are already in your inbox.
What Happens When a Message Is Deleted?
When an OTP is auto-deleted, it’s moved to the trash, not permanently erased. Google Messages has a trash folder where deleted messages stay for 30 days before being permanently removed. You can access it by tapping the three-dot menu in the app and selecting Trash.
You can restore a message from the trash if it was deleted by mistake. However, the auto-delete feature doesn’t send you a notification when it deletes a code—it just happens silently. If you need the code later (for example, if you didn’t use it in time), you can check the trash, but it’s best to use the code before the deletion period ends.
Common Problems and How to Fix Them
Here are a few issues you might run into and what to do:
- Can’t find the setting: Make sure your app is updated. If it’s still missing, your device may not have received the feature yet. Check the Google Play Store for updates.
- OTPs aren’t being deleted: Verify that the feature is toggled on and that the messages are actually being recognized as OTPs. If the sender uses an alias or a custom format, it might not trigger the detection.
- Accidentally deleted a code you needed: Go to Trash within 30 days and restore the message. If it’s been longer, it’s gone permanently.
- Feature not working on your phone: Some older Android versions or custom skins (like Samsung’s One UI) may have different settings paths. Search for “OTP� in the settings search bar inside the Messages app.
Comparison: Google Messages vs. Other Options
Google Messages isn’t the only way to handle OTPs. Here’s how it compares to other common approaches:
- Manual deletion: You can always delete messages yourself, but it’s easy to forget. Auto-deletion is more reliable.
- Third-party SMS organizers: Apps like Microsoft SMS Organizer (Android) can also auto-delete OTPs, but they require extra permissions and may not be as integrated with Google’s ecosystem.
- Password managers: Many password managers (like 1Password or Bitwarden) can read OTPs and store them securely, but they don’t delete the SMS. You’d still need to delete the message manually.
- Authenticator apps: Instead of SMS, you can use an authenticator app (like Google Authenticator) that generates codes on your device. These don’t rely on SMS at all, so there’s no message to delete. That’s generally more secure, but it requires you to set up each service individually.
For most people, auto-deletion is a good middle ground: it’s automatic, built-in, and doesn’t require extra apps. If you want stronger security, consider moving to an authenticator app for the services that support it.
Frequently Asked Questions
Does auto-deletion work for all types of OTPs?
No. It works for messages that Google’s algorithm identifies as OTPs based on patterns like short numeric codes and context words. If a service sends a code in an unusual format, it might not be recognized and won’t be deleted.
Can I recover a deleted OTP?
Yes, for a limited time. Deleted messages go to the Trash folder, where they stay for 30 days. You can restore them from there, but after 30 days they’re permanently erased.
Will auto-deletion affect my regular messages?
Only messages that are detected as OTPs will be auto-deleted. Regular conversations are unaffected. However, false positives can happen, so it’s a good idea to check the Trash occasionally if you’re worried.
Is the feature available on iOS?
No. Google Messages is an Android app. On iOS, you can use the built-in “Clean Up Verification Codes� feature in the Messages app, which works similarly but is separate from Google’s implementation.
Does auto-deletion work with RCS?
Yes, it works with both SMS and RCS messages. As long as the message is in the Google Messages app, the feature can detect and delete OTPs.
Will enabling this feature stop me from receiving OTPs?
No. You’ll still receive the messages normally. The feature only deletes them after the chosen time period (e.g., 24 hours). You’ll have plenty of time to use the code.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.