My codes are being rejected. What should I check?
Troubleshooting · Help center · Current as of 2026-10-10
Short answer
Almost always the device clock. A TOTP code is computed from the time, so a device more than about a minute off produces codes every service will reject. Turn on automatic time setting and try again — that fixes the large majority of cases.
In order of likelihood
- The clock. Enable automatic date and time on the device. Services typically accept a code from one 30-second step either side, so a few seconds of drift is fine and a few minutes is not.
- Only one service failing. Then it is not the clock. That service probably issued non-default parameters — SHA-256, eight digits, a 60-second period — and the entry needs to match what its QR specified.
- A code that expired as you typed it. Wait for the next one rather than submitting a code with two seconds left.
- An HOTP entry out of step. Counter-based entries advance each time a code is generated. Generating several without using them can push the counter past what the service will look ahead to.
- The wrong account. With several entries from one provider, check the account name, not just the issuer.
If none of that is it
Compare the entry against a freshly issued QR from the service: disable and re-enable 2FA there and add the new QR. That rules out a secret that was mistyped or truncated when it was first added. TOTP vs HOTP explains why each of these breaks a code.
The long version of this page, with each cause worked through and the recovery routes when no code will ever be accepted, is 2FA code not working: causes and fixes, in order. It has app-specific companions for Google Authenticator, Microsoft Authenticator and Authy.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms