diff --git a/src/modules/auth/auth.service.ts b/src/modules/auth/auth.service.ts
index 760295c..d837b52 100644
--- a/src/modules/auth/auth.service.ts
+++ b/src/modules/auth/auth.service.ts
@@ -128,7 +128,7 @@ export class AuthService {
     const mobile = this.normalizeMobile(dto.mobile);
     const code = String(dto.code ?? '').trim();
 
-    if (!/^\d{4,8}$/.test(code)) {
+    if (!/^\d{4}$/.test(code)) {
       throw new BadRequestException('Invalid OTP code');
     }
 
@@ -283,7 +283,7 @@ export class AuthService {
   }
 
   private generateOtpCode(): string {
-    return String(randomInt(100000, 1000000));
+    return String(randomInt(1000, 10000));
   }
 
   private hashOtp(mobile: string, code: string): string {
diff --git a/src/modules/auth/dto/verify-otp.dto.ts b/src/modules/auth/dto/verify-otp.dto.ts
index 75203dd..f0e3154 100644
--- a/src/modules/auth/dto/verify-otp.dto.ts
+++ b/src/modules/auth/dto/verify-otp.dto.ts
@@ -8,10 +8,10 @@ export class VerifyOtpDto {
   @IsIranMobile()
   mobile!: string;
 
-  @ApiProperty({ example: '123456' })
+  @ApiProperty({ example: '1234' })
   @IsString()
-  @Matches(/^\d{4,8}$/, {
-    message: 'code must be 4 to 8 digits',
+  @Matches(/^\d{4}$/, {
+    message: 'code must be 4 digits',
   })
   code!: string;
 }