Module codes 

One-time codes, passwords, password resets, sign-in links and addresses to confirm, sent by mail.

You asked for them a moment ago, on a site, and they expire within minutes or hours: they are the one exception to the admin windows, shown at once and quietly, from automatic addresses too (docs/porch.md, “Right now”). Fake “your code” messages are a common phishing trick: a forged one was set aside before, and one whose sender is not verified comes with a warning. The words it looks for are the codes lists of the word packs in use, with your changes (words::Codes, docs/words.md).

Many sites send these through the same services as their newsletters, with the same headers (List-Unsubscribe, Precedence: bulk): those headers never decide that a message is not a code (detect_message). They only narrow where a code is looked for: in the subject and the top of the text, where a site puts what you asked for, and not in a newsletter’s articles, which talk about passwords without handing one over.

Structs

Found 🔒

A code-shaped stretch of the text: where it is, the code as kept, and whether it mixes letters and digits (then read only right after its phrase).

OneTimeCode

A short-lived secret found in a message.

Token 🔒

A token and what surrounds it, enough to tell a code from a price or a phone number.

Enums

CodeKind

What kind of short-lived secret a message carries.

Constants

AFTER_WINDOW 🔒

How far around the phrase a code is looked for, in characters.

BEFORE_WINDOW 🔒

BRIEF_MINUTES 🔒

The longest a link said to expire may last to be one you just asked for: two days (“valid for 48 hours”); a sale’s “valid until Sunday” is none.

INTENT_LEAD 🔒

Characters of the text, after the subject, where a sign-in link’s message says what it is about (“Click the link below to sign in”).

LEAD 🔒

Characters of a bulk message’s text read, its web addresses left out (detect_message): the top, where a site puts the code you asked for.

LONGEST_MINUTES 🔒

The longest a message stays “right now”, whatever it says: a week, as a password waiting for its first use. “Valid for 90 days”, written by anyone, would otherwise keep it on top for three months.

SCAN_LIMIT 🔒

Characters of subject and body looked at: codes sit at the top of these messages.

VALIDITY_WINDOW 🔒

How far after “link” its validity is said, in characters.

Functions

amount_follows 🔒

“€”, “%” or “euros” right after: an amount.

code_beside 🔒

The code next to a phrase: right after it, whatever its shape (“votre code est : 482 913”, “your sign-in code: K7Q-2M9”); else, for a phrase of Codes::code, digits further after it, or the nearest before it (“G-482913 is your Google verification code”).

code_from 🔒

Whether a token alone is a code: 4 to 8 digits (not a year, a price or a phone number), a prefixed code (“G-482913”), or two groups of three or four digits joined by a hyphen (“123-456”), kept as digits.

code_in 🔒

The code beside the first phrase, in the text’s order, that has one; else a code said to be yours right after it (“123456 is your Instagram code”).

codes 🔒

Every code-shaped stretch of the text, in order. Groups of digits of the same size one space apart, a non-breaking one too (“482 913”, “48 29 13”), are read together, a code or none: a phone number or an amount is read whole, never in parts. Groups of other sizes are read one by one.

detect

Finds a short-lived secret in a message, if it carries one. Phrases are compared folded: lowercase, without accents (see text).

detect_message

Finds a short-lived secret in a message read from mail. Bulk headers (Card::is_list: List-Unsubscribe, List-Id, Precedence: bulk) are how many sites send codes and links too, so they never rule one out: they only narrow the reading to the subject and the top of the text (LEAD), and a phrase that hands nothing over by itself (a reset, a link, an address to confirm, a password), when it is not in the subject, counts only beside a line that answers a request (“if you did not ask for this…”, Codes::request) or a link said to expire. A newsletter’s article on passwords is none.

every_hit 🔒

Every place of each phrase in the text, as (start, end) positions.

expiry_minutes 🔒

“valable 10 minutes”, “expires in 15 minutes”, “valid for 1 hour”, “for 7 days”.

first_hit 🔒

The earliest of the phrases in the text, as (start, end) positions.

grouped_code 🔒

Digits printed in groups of the same size, 4 to 8 in all: “482 913”, “48 29 13”, “4 8 2 9 1 3”, “4829 1357”. A phone number (“06 12 34 56 78”), a card’s number or an amount (“120 450 €”) is none.

hyphened_code 🔒

“123-456”, “4829-1357”: two groups of digits of the same size, three or four, joined by a hyphen; a date (“2026-10”) or a phone number is none.

is_digits 🔒

is_in 🔒

Whether a folded word is one of a list’s, the list’s words folded too.

is_space 🔒

A space between groups of digits: plain, non-breaking, narrow, thin or figure.

is_year 🔒

lasts_briefly 🔒

Whether a link, its button or a code is said to expire soon or to work once: “This link expires in 15 minutes”, “ce lien n’est valable qu’une fois”.

looks_like_amount_or_year 🔒

mixed_code 🔒

A code of letters and digits (“K7Q-2M9”, “AB12CD”, “F7G2K”): 5 to 10 characters, uppercase, two letters and two digits at least, so that no word is one; read only right after its phrase (code_beside).

named_after 🔒

A code followed by what says it is yours: “123456 is your Instagram code”, “482913 est votre code de vérification”. Up to three words between “your” and “code”, none that makes it no secret.

owned_codes 🔒

“Your Instagram code”, “your Uber login code”, “votre code Instagram”: the owner, up to two words, “code”, and in French a name after it, written with a capital (“Instagram”, never “postal”); none of the words one that makes it no secret (Codes::not_yours), nothing but spaces between them. As (start, end): what must be followed by the code itself.

prefixed_code 🔒

“G-482913”: letters, a hyphen, 4 to 8 digits.

read 🔒

ties 🔒

Whether what stands between a phrase and a code ties them: spaces, a colon, “is” or “est”. After “your code”, a colon or one of these words at least: “votre code postal : 54390” gives no code.

tokens 🔒

Maximal runs of letters, digits and hyphens.

words 🔒

The words of a text, as (start, end) positions: runs of letters and digits, with the hyphens and apostrophes inside them (“sign-in”, “d’accès”).