Do we need this length check? A large string should still fail the OTP check below?