Free Outlook OTP Reader for Outlook & Hotmail

You are halfway through signing in, the website sends a code, and now you need to find the right inbox tab. It is a small interruption. If you spend much of your day in a terminal, a small script can remove it.

The free Outlook / Hotmail OTP reader by qcodrr is a Python program that looks for verification codes in your own Microsoft inbox and prints a match. It uses Microsoft Graph and browser-approved sign-in. No store purchase is needed.

How to set up the free Outlook OTP reader

You need Python 3 with pip, Git if you use the commands below, a personal Microsoft mailbox and an application client ID. The source uses the consumers sign-in endpoint: this version targets personal Outlook.com, Hotmail.com and Live.com accounts, not work or school tenants.

1. Download the project and install its dependencies

Review the repository before running it. Clone it, or use GitHub’s Download ZIP option and open a terminal in the extracted folder. A virtual environment keeps its two listed dependencies, msal and requests, separate from other Python projects.

git clone https://github.com/qcodrr/outlook-hotmail-otp-reader-python.git
cd outlook-hotmail-otp-reader-python
python -m venv .venv

Activate the environment on macOS or Linux:

source .venv/bin/activate

On Windows Command Prompt:

.venv\Scripts\activate.bat

Then install the dependencies:

python -m pip install -r requirements.txt

If your system uses python3 instead of python, use that command to create the environment. This guide covers setup; we have not run the program against a live mailbox.

2. Supply your own Microsoft app client ID

In Microsoft’s app registrations area, create an app that supports personal Microsoft accounts. Enable public client flows in its authentication settings and copy the Application (client) ID. The repository’s setup section describes the intended configuration; Microsoft documents the public-client setting separately. Access to app registration depends on your Microsoft account and directory permissions.

Create a file named client_id.txt beside otp_reader.py and put only that client ID inside. This is the app’s identifier, not your password or a client secret. The script also accepts the OTP_CLIENT_ID environment variable.

3. Sign in to your mailbox

python otp_reader.py

The first run prints a Microsoft device-login instruction and a short code. Follow it for the session you just started, check the app and account shown, and review the requested permission before approving. Never approve a device code sent to you by somebody else.

The script requests delegated Mail.Read. That is mail-reading access, not just permission to see OTPs. Microsoft’s permission reference describes the scope. The reviewed script reads Inbox messages; it does not send mail.

Commands you will actually use

python otp_reader.py                 # newest candidate code
python otp_reader.py --watch         # wait for a different code, then exit
python otp_reader.py --from github   # match sender name or address
python otp_reader.py --list 10       # inspect recent message subjects
python otp_reader.py --accounts      # show mailboxes you added
python otp_reader.py --logout        # clear all local cached logins

The default command checks each cached mailbox. To add another mailbox you control, run python otp_reader.py --add and complete its own browser approval. Use --account with enough of the email address to identify the account you want; the filter matches text, not an exact account ID.

Watch mode polls every five seconds by default. It records the current code first, then exits when it sees a different matching code. Start watching before requesting the next email. This is polling, not instant push delivery, and it is not an always-running inbox monitor.

No code found? Check the email, not just the script.

The scan uses the newest ten messages in the Inbox and searches their subject lines and body previews. It prefers numbers near code-related words, then falls back to numeric matches. That keeps it simple, but a number in an email is not always a login code.

• Wrong folder: check webmail for Junk or a rule that moved the message. This version scans Inbox, not every folder.
• Sender filter too narrow: --from filters the messages already fetched. It does not search all older mail from that sender, and it is not sender verification.
• Code outside the preview: an image, an alphanumeric code or text deeper in the message may not match. Open the email directly.
• Same digits again: watch mode compares code values. A new email with the same digits as the starting code may not be reported.
• Expired login: the program may ask you to run --add again. A cached login is not a promise of permanent access.

Check the sender and subject printed with the result, and confirm the email’s time in webmail if freshness matters. A normal run does not validate a code’s expiry or whether the requesting service still accepts it.

No password file does not mean no sensitive files

Microsoft handles the browser login. The program saves its token cache in .token_cache.json beside the script, without adding file encryption in the reviewed code. Treat that file as sensitive: keep it out of shared folders, Git commits and support attachments. Terminal output can contain active codes too.

--logout removes the local cache for every added account. To review or withdraw the app’s consent, use Microsoft’s account permissions page. Local cleanup and provider-side consent are separate actions.

Do you need Full OAuth accounts to use it?

This program creates its own browser-approved sign-in session. It has no import option for the store’s email:password or Full OAuth delivery files. Buying a particular format does not replace the interactive approval or guarantee that this reader will work with an account.

If you are choosing a mailbox separately, compare the actual access details on our Outlook account page or Hotmail account page. For general mail-client setup rather than this script, use the OAuth and IMAP guide.

Source reviewed: repository revision e8c901a, including the README, Python script and requirements. Upstream behavior can change. This is a third-party project, not a Microsoft product or an endorsement by Microsoft.