To improve security, we increased the length of one-time passwords (OTPs), also known as verification codes, from five digits to six. This change applies to OTPs sent through email and SMS. If you have customizations that rely on five-digit OTPs, such as Apex implementations for multi-factor authentication or passwordless login, make sure you update them.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in all editions.
Email and SMS One-Time Password Codes Are Longer (salesforce.com)