Thwarting one-time password (OTP) theft. In one embodiment, a method may include receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP. The method may also include encrypting, by the messaging application, the original OTP included in the text message to thwart theft of the original OTP from the text message.