Why Is My 2FA Code Invalid? 7 Common Causes and Fixes

Few things are as frustrating as typing a six-digit code you can see right there on your screen and being told it is wrong. You try again. Wrong again. Now you are worried about being locked out.

The good news is that "invalid code" errors from authenticator apps almost always come down to a small number of causes, and most of them take less than a minute to fix. Work through the list below roughly in order; the first two account for a large share of problems.

A quick bit of background

Authenticator apps use TOTP (RFC 6238). Your app and the website share a secret key, and both combine it with the current time to compute a code that changes every 30 seconds. If the key, the time or the account does not match, the codes will not match either. Keep that in mind as you read: every cause below breaks one of those three things.

1. Your device clock is out of sync

This is the classic cause. Because the code depends on the time, a phone or computer whose clock is off by more than a little will produce codes for the wrong 30-second window. Servers usually tolerate a small difference, often about one time step, but not much more.

A clock can drift if it was set manually, after travelling, after the battery fully drained, or on a computer whose time sync has stopped working. Note that time zone is not the issue: the code uses UTC internally. What matters is that the actual time is correct.

The fix is to turn on automatic time. Menu names may vary slightly by version and manufacturer.

Android

1. Open Settings.
2. Go to System and then Date & time. On Samsung phones this is usually under General management and then Date and time.
3. Turn on Set time automatically (sometimes called "Automatic date and time" or "Use network-provided time").

iPhone and iPad

1. Open Settings and tap General.
2. Tap Date & Time.
3. Turn on Set Automatically. If it is greyed out, a Screen Time restriction or device management profile may be blocking the change.

Windows 11

1. Open Settings and choose Time & language, then Date & time.
2. Turn on Set time automatically.
3. Under additional settings, click Sync now to force an immediate update.

macOS

1. Open System Settings, then General, then Date & Time.
2. Turn on Set time and date automatically.

After enabling automatic time, wait for the next code to appear and try that one. If your clock was the problem, the new code should work straight away.

2. You are reading the code for the wrong account

If you have several entries in your authenticator app, especially several for the same service, it is easy to grab the wrong one. Entries with the same issuer and no clear account name look almost identical.

How to fix it:

• Check the account name under each entry, not just the service logo.
• Rename entries so they are unambiguous, for example "Email - work" and "Email - personal".
• Delete entries for accounts you closed long ago, so they do not cause confusion.

3. 2FA was reset, so the old key is dead

Every time 2FA is disabled and re-enabled on an account, the service generates a new secret key. The old entry in your app still happily shows codes, but they are calculated from a key the server no longer accepts.

This often happens after you set 2FA up a second time "just to be sure", after support reset it for you, or when you scanned the QR code but never finished the confirmation step, so the service discarded that key.

The fix: look for the most recently added entry for that account and try its code. If none work and you are still logged in somewhere, go to the security settings, set up 2FA again, and delete the old entry from your app afterwards so you do not mix them up. If you are fully logged out, use a recovery code or the service's account recovery process.

4. A typo in a manually entered key

If you typed the secret key by hand instead of scanning the QR code, a single wrong character makes every code wrong, while still looking perfectly normal.

The key helps you here. TOTP keys are written in Base32, which uses only the letters A to Z and the digits 2 to 7. The digits 0, 1, 8 and 9 never appear. That means:

Other things to check: you did not miss or duplicate a character, especially in long keys shown in groups of four; you selected time-based rather than counter-based when adding the entry; and you copied the whole key, not a truncated part. When possible, copy and paste the key instead of retyping it.

A quick way to test a key you already have is to paste it into the 2FA-Auth code generator and compare the code with your app. If both show the same code but the website still rejects it, the key is fine and the cause is elsewhere on this list.

5. The code expired while you were typing

Codes change every 30 seconds. If you start typing with three seconds left, the code may be stale by the time you press Enter, particularly on a slow connection.

The fix is simple: glance at the countdown before you start. If there are only a few seconds left, wait for the next code. Many services accept the previous code for a short grace period, but you should not rely on it.

Also make sure you are not reusing a code. Some services reject a code that has already been used once, even within its window, to prevent replay.

6. The service expects a different kind of code

Many accounts support several 2FA methods, and the login screen does not always make clear which one it wants. You might be typing an authenticator app code where the service expects:

• a code sent by SMS or email,
• a backup or recovery code, which is usually longer, or
• a push approval or security key tap instead of any code.

Read the prompt carefully. Look for a link like "Try another method" or "Use a different verification option" to switch to the authenticator app. And if you recently received an SMS code, remember it is completely separate from the code in your app; they will never match each other.

7. You hit a rate limit or temporary lockout

To stop attackers from guessing codes, services limit how many attempts you can make. After several failures, some will keep saying "invalid code" even when you finally enter the right one, or will lock verification for a period of time.

What to do:

1. Stop trying for a while. Repeated attempts may extend the lockout.
2. Fix the underlying cause first, usually the clock or the wrong entry, using the steps above.
3. Come back later and try once with a fresh code.
4. If the lockout persists, use a recovery code or the service's official recovery process.

When nothing works

If you have checked the clock, the account, the key and the method, and you are still stuck, use your recovery codes. They exist exactly for this situation. If you do not have them, the service's official account recovery is the only safe route. Be cautious about anyone offering to "unlock" an account for you through messages or social media; legitimate recovery happens through the service itself.

Once you are back in, take five minutes to prevent a repeat: turn on automatic time on every device you use for codes, label your entries clearly, and save your key or recovery codes somewhere safe.

FAQ

Why does my code work on one device but not another?

Both devices may hold the same key, but one of them probably has an incorrect clock. Enable automatic time on the device that fails. If the clocks are correct, the two entries may be using different keys from separate setups.

Does changing time zones break 2FA codes?

No, as long as the device's actual time is correct. TOTP uses UTC internally, so a correct clock in any time zone produces the right code.

How many wrong attempts are allowed before a lockout?

It depends on the service, and most do not publish the exact number. Assume only a handful, and fix the cause before trying again rather than guessing repeatedly.

My new phone shows codes but they are all wrong. Why?

If you transferred accounts, check the phone's clock first. If you re-scanned old screenshots or old QR codes, those keys may have been replaced when 2FA was reset. Set up 2FA again from the account's security settings to get a current key.