Where is the java web verification code generally saved after it is generated? Save it in a database or something?

Speaking of verification code, it has something to do with security, and then it has something to do with your timeliness. This is not a session (it is the only certificate for the client to use the server resources, and it is time-limited. If the user has not visited the server for a long time, this session will be cancelled automatically). The responsibility is not great, and the usability is not a problem. As for the encryption you said, this is redundant.

According to upstairs, it was a mistake. The server must save this verification code. Just like I gave you a verification code, you can use it, and I have to back it up and compare it with you. Otherwise, it will become: You said your verification code was correct and you verified it, so I trust you. That means that without a password, all the security authentication of the client is not credible!