You open your authenticator app, see a code, switch to the login page — and by the time you type it in, the code has changed. This is one of the most common 2FA frustrations, and it has a simple explanation and several easy fixes.
In This Guide
Why 2FA Codes Expire in 30 Seconds
TOTP (Time-based One-Time Password) codes are generated using the current time as an input. Every 30 seconds, a new code is calculated from your secret key and the current Unix timestamp. The server does the same calculation and compares the two — if they match within a small window, you're in.
The short expiry is intentional and a core security feature. A code that lasted 5 minutes would give an attacker much more time to intercept and use it. 30 seconds is the standard defined in RFC 6238.
Fix 1: Watch the Timer and Wait for a Fresh Code
Every authenticator app shows a countdown — either a shrinking arc, a progress bar, or a number counting down from 30. If the timer is below 5 seconds when you open the app, don't rush. Wait for the timer to reset and a fresh code to appear. You'll then have a full 30 seconds to enter it.
This is the simplest fix and works for most people who are regularly running out of time.
Fix 2: Copy the Code Instead of Typing It
Typing a 6-digit code under time pressure invites errors. In most authenticator apps you can tap the code to copy it to your clipboard, then paste it into the login field. This takes under a second and eliminates mistyping.
On Google Authenticator and Authy, tap the code once to copy. On iOS, long-press the code for the copy option.
Fix 3: Use a Browser-Based Tool on the Same Device
If you're logging into a website on your computer, switching to your phone to get the code costs 5–10 seconds. Using a browser-based TOTP generator like 2faco.com means your code is right there in the same browser tab — paste your secret key once and the current code is always visible. Nothing leaves your device.
This is especially useful for accounts you access frequently from a desktop.
Fix 4: Sync Your Device Clock
If your device clock is even a minute off from the real time, the codes your app generates will be out of sync with what the server expects. The server checks a small window (usually ±1 period = ±30 seconds) but if your clock is more than that off, every code will fail.
On Android: Settings → General Management → Date and Time → enable "Automatic date and time". On iPhone: Settings → General → Date & Time → Set Automatically. On Google Authenticator specifically, there's a "Time correction for codes" option in the app settings.
Fix 5: Try the Previous Code
Most authentication servers accept a one-period grace window — meaning they'll also accept the code from the previous 30-second window. If your code just changed right as you were entering it, try the code that was showing immediately before the refresh. Many people don't know this works.
This grace window exists precisely because clocks aren't perfectly synchronised across the internet and to account for slow network responses during the login process.
Common Mistakes That Eat Up Your 30 Seconds
Most people who regularly run out of time are losing it in the same places. Unlocking your phone, opening the authenticator app, waiting for it to load, switching back to the browser, and then typing — each step costs a second or two, and together they can easily exceed the code's lifetime. If you habitually miss the window, watch yourself go through the flow once and note where the delay actually happens; it is almost never the typing itself.
A few specific habits make the problem worse: reading the code out of a notification instead of the app (notifications can lag behind the current code), trying to enter the previous code after a refresh instead of waiting for a fresh one, and leaving the login page idle while you do something else. Try preparing the login field first — click into the password or code box before opening your authenticator, so the moment the code is copied you can paste it straight in.
Why the 30-Second Window Actually Protects You
It can be tempting to wish for longer codes, but the short expiry is deliberate. A TOTP code is only useful to an attacker while it is still valid; the shorter the window, the less time an intercepted code can be replayed. Thirty seconds is the standard defined in RFC 6238, and most servers also enforce a one-period grace window, meaning a code is effectively usable for around a minute in total.
If codes lasted several minutes, an attacker who captured one — through malware, a shoulder-surfed screen, or a phishing page that relays codes to the real site in real time — would have a much larger window to use it. The slight inconvenience of racing a timer is the price of making stolen codes nearly worthless. That is also why you should never screenshot or message your codes to anyone: the window is short, but an automated attacker does not need long.
Summary
2FA codes expire quickly by design. The practical fixes are: wait for a fresh code before starting, copy rather than type, use a browser-based tool if you're on desktop, and make sure your device clock is synced. If none of these help, a time sync issue is the most likely culprit.
Why Some Services Use Longer Windows or Bigger Codes
Thirty seconds is the standard, but it is not the only setting. RFC 6238 allows the time step to be configured by the service, and you will occasionally encounter 60-second windows or 8-digit codes — some banks and enterprise systems choose longer windows because their users are slower and their risk profile tolerates it. Your authenticator app always displays whatever the service requires: a 60-second countdown for a 60-second window, an 8-digit code for a service that asks for eight. You cannot change the step size from your side, and you should not want to — a longer window means a stolen code stays usable for longer.
One practical consequence: if you are used to 30-second habits, a service with a 60-second window will feel forgiving, while one with 8-digit codes will feel slower because there is simply more to read. Adjust the same tactics — wait for a fresh code, copy it, paste it — regardless of the format.
Getting Codes From a Smartwatch or Wearable
If you frequently race the timer, a wearable version of your authenticator can help because the code is on your wrist — no phone unlock, no app switch, no browser handoff. Watch apps for Authy and several TOTP tools mirror the codes from your phone to the watch, and the whole read-and-type sequence drops to a couple of seconds. The trade-off is the display: a small screen is easy to misread, and mistyping one digit costs you a full window anyway.
Treat the watch as a convenience copy of your phone, not a replacement. Most watch apps require the phone to be nearby, so they do not help when you leave the phone at home — in that scenario, printed backup codes or the service's SMS fallback are the real safety net. If you do use a watch, keep the phone's authenticator app up to date, since the watch code is generated from the same secret and the same clock.
Letting Autofill Enter the Code for You
Password managers such as 1Password and Bitwarden can store the TOTP secret with a login entry and fill the code into the web form automatically, which removes typing entirely and usually beats the timer by a wide margin. The code is inserted the same moment the password is, so the sequence is: open the manager, copy or auto-fill both fields, submit. Desktop apps and some mobile browsers support this; if yours does not, the manager can still copy the code to your clipboard on demand.
There are two caveats. First, autofill only works when the site's 2FA field is recognised — some banking portals use bespoke login screens where you must type manually. Second, storing secrets in a manager concentrates your 2FA in the same vault as your passwords, so enable the manager's own MFA and keep your vault backed up; otherwise a lost vault means re-enrolling everything at once.
When the Code Changes Before the Login Page Even Loads
On a slow connection the sequence can feel absurd: the page takes 20 seconds to load, you paste the code, and the server replies that it expired. The fix is not typing faster — it is preparing before the page finishes. Load the login page first, then generate or copy the code, so the code is always fresh when the form is ready. If a page genuinely takes longer than 30 seconds to respond, do not resubmit the same code repeatedly; wait for the new code and submit once, and check whether the site shows its own countdown in the 2FA field, which tells you how much time remains server-side.
If this happens consistently on one particular site but nowhere else, the problem is that site's slow login flow, not your timing. In that case use the previous-code trick from Fix 5 first, and if the site rejects it, treat slow responses as a reason to keep a browser-based generator in the same window so the code refreshes without leaving the page.