Time sync is the first thing to check
TOTP uses the current Unix time and a time step, usually 30 seconds. If your device clock is wrong or a code is entered near the end of its window, the service may reject it.
Why is my 2FA code not working?
A TOTP authenticator code only works when the service and the generator share the same secret, time window, and parameters. Use this checklist when a 2FA or MFA code is rejected, expired, invalid, or different from another authenticator app.
Use the right setup secret
Each account should have its own setup secret. A code from the wrong account, issuer, workspace, or old setup key will look valid in the generator but fail on the login page.
Match TOTP parameters
Most services use SHA-1, 6 digits, and 30 seconds, but some use SHA-256, SHA-512, 8 digits, or a custom period. The generator must match the service settings.
Do not confuse code types
A TOTP authenticator code is not an SMS code, email code, push approval, passkey prompt, backup code, or recovery code. The login page must be asking for an authenticator app code.
Wait for a fresh code
If a code is near expiration, wait for the next one before submitting. Some services also reject reusing the same one-time code after it has already been accepted once.
Use recovery only when needed
If the setup secret is lost, deleted, or replaced during a new 2FA setup, a generator cannot recreate the correct code. Use recovery codes or the service's account recovery flow.
Invalid 2FA code troubleshooting matrix
Use this table to match the failure symptom with the most likely TOTP cause, the check to run, and the safest next fix.
| Symptom | Likely cause | What to check | Fix |
|---|---|---|---|
| Code is rejected even when copied quickly | Device or browser time is out of sync | Compare the device time with an automatic network clock and wait for the next 30-second window | Enable automatic date, time, and time zone, then reload the generator |
| Another authenticator app shows a different code | Different account, issuer, workspace, or setup secret | Compare the issuer, account label, email address, and original Base32 setup key | Use the setup key for the exact account that is asking for the code |
| The key is accepted but the code never works | Copied setup key is incomplete or has a wrong character | Re-copy the Base32 secret or full otpauth URI from the account setup screen | Paste the original setup value again and preserve every character |
| Code length or timer differs from the service | Algorithm, digits, or period do not match | Look for SHA-1/SHA-256/SHA-512, 6 or 8 digits, and the period in the otpauth URI or setup page | Set the same algorithm, digit count, and period as the service |
| Code works sometimes but fails near countdown end | The code expires before the service verifies it or was already used | Check how many seconds remain and whether the same code was submitted before | Wait for a fresh code and submit it early in the time window |
| Login page asks for a different verification method | The page wants SMS, email OTP, push approval, passkey, hardware key, backup code, or recovery flow | Read the wording on the login page and confirm it asks for an authenticator app code | Use the requested method or account recovery; a TOTP generator cannot create those codes |
Fix an invalid TOTP authenticator code
Check the device clock
Enable automatic date, time, and time zone on the device running the generator, then reload the page or wait for the next TOTP window.
Wait for a new code
Avoid submitting a code with only a few seconds left. Wait until the countdown resets, then copy the new code immediately.
Confirm the correct account
Make sure the generator name, issuer, email address, workspace, or service label matches the login page that is rejecting the code.
Re-paste the setup key or otpauth URI
If the code still fails, paste the original Base32 setup key or otpauth://totp/ link again to avoid a missing or wrong character.
Match algorithm, digits, and period
Use the same algorithm, digit count, and period shown by the service. Common defaults are SHA-1, 6 digits, and 30 seconds.
Use recovery if the secret changed
If 2FA was reset, moved, or deleted, the old secret may no longer work. Use a recovery code or contact the service owner.
Standards and references
- RFC 6238: TOTP: Time-Based One-Time Password Algorithm
- NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management
FAQ
Why does my 2FA code say invalid?
The most common reasons are device time drift, using the wrong account's secret, copying the setup key incorrectly, or using TOTP parameters that do not match the service.
Does the 30-second timer matter?
Yes. A code generated at the end of a time window may expire before the service verifies it. Waiting for a fresh code often fixes intermittent failures.
Can an old authenticator code work again?
Usually no. TOTP codes are short-lived, and many services reject a code once it has already been used successfully.
Why do two authenticator apps show different codes?
They may use different setup secrets, account labels, algorithms, digit counts, periods, or device clocks. Compare the original setup key and parameters.
Can this tool fix a lost 2FA secret?
No. A valid TOTP code requires the shared setup secret. If the secret is lost, use backup recovery codes or the account provider's recovery process.