Android 17 now hides one-time security codes from most apps for three hours

Android 17 adds a timed barrier around one-time security codes delivered to a phone. Google says the operating system automatically hides those codes from most apps for three hours, reducing the opportunity for malicious software to capture a short-lived login credential.

The change targets a narrow but consequential attack path. A texted code is designed to expire quickly, yet malware only needs a brief look at a notification, message or copied value to relay it to a criminal during an active sign-in attempt.

The protection creates a three-hour blackout

In its 2026 Android security and privacy announcement, Google said Android 17 would hide sensitive one-time codes from most apps for three hours. The operating system identifies the code as sensitive and limits other software’s access during the period when the credential is most useful to an attacker.

The wording “most apps” is important. Google has not described the feature as an absolute block on every program or system component. Legitimate services still need mechanisms to receive messages and complete account verification, while emergency, accessibility and device-management functions can involve special permissions. The protection should therefore be treated as an additional boundary, not a guarantee that a code can never be exposed.

SMS access has long carried security risk

Android already restricts access to text messages because they can contain private conversations and authentication credentials. The platform’s developer guidance on SMS and MMS risks advises apps to avoid broad message permissions when more limited verification methods are available. A malicious app with excessive access can collect data far beyond the function that persuaded a person to install it.

One-time codes are especially attractive because they can defeat a password-only barrier in real time. Criminals may combine a stolen password with phishing, notification access, screen sharing or malware. A three-hour hiding window is far longer than the normal useful life of most codes, so a captured value should be invalid by the time the restriction expires.

The automatic approach also avoids asking each recipient to recognize which incoming digits are authentication secrets. Protection at the operating-system layer can apply across participating messaging and verification flows before an untrusted app gets an opportunity to inspect the content.

The feature does not fix every code-based attack

Operating-system isolation cannot prevent a person from entering a code into a convincing phishing page. It also does not stop a carrier-account takeover, a fraudulent number transfer or an attacker who already controls the account’s recovery channels. Malware with broader control of a compromised device may create risks outside the specific app-access path Google is closing.

Notification previews and lock-screen settings remain relevant. Even when software cannot programmatically extract a code, a visible preview can reveal it to someone holding the phone or watching a shared screen. Account holders can reduce exposure by hiding sensitive notification content and removing unnecessary accessibility or notification-listener privileges from unfamiliar apps.

Android 17 availability will vary by device

The announcement describes an Android 17 capability, not an instant change to every Android phone. Operating-system releases reach Google devices first, then move through manufacturers and carriers on different schedules. Older phones that cannot install Android 17 will not gain this specific protection merely because the feature has been announced.

Device makers can also implement interface details differently while using the underlying Android security controls. The reliable way to determine coverage is to check the installed Android version and current security update in system settings. Keeping the operating system and Google Play system components current remains important because security layers often depend on several updated services working together.

Phishing-resistant sign-in remains stronger

Texted codes improve on a password alone, but they remain vulnerable to social engineering and weaknesses in the telephone network. Passkeys and hardware security keys bind authentication to a legitimate website or app, making a credential harder to relay to an imitation login page. The Cybersecurity and Infrastructure Security Agency’s authentication guidance recommends stronger multifactor methods where accounts support them.

Authenticator apps can also avoid the carrier channel, although a manually typed authenticator code can still be phished. For sensitive email, financial and cloud accounts, the best available option is usually a passkey or security key, followed by an authenticator app. SMS can remain a fallback when a service offers nothing stronger.

A narrow defense can still disrupt real attacks

Security improvements rarely eliminate an entire class of fraud. Their value often comes from forcing attackers to abandon cheap, repeatable techniques. Automatically shielding codes removes the need for each app developer to design a separate defense and protects people who never review permission menus.

The three-hour rule is best understood as containment during the credential’s danger window. It does not make text messages private forever, nor does it replace careful account security. It does make a stolen one-time code less accessible to ordinary apps at the moment a criminal would need it most.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview