You enter your 2FA code and get "Invalid verification code" — even though it looks correct. This is one of the most frustrating 2FA problems, and almost always has a simple fix.
In This Guide
Fix 1: Sync Your Device Clock (Most Common Fix)
TOTP codes are time-based. If your phone's clock is even 30–60 seconds out of sync, every code you generate will be invalid.
Android: Settings → General management → Date and time → enable Automatic date and time
iPhone: Settings → General → Date & Time → enable Set Automatically
Fix 2: Wait for the Next Code
TOTP codes expire every 30 seconds. If you enter a code in the final second of its cycle, the server may reject it as too old. Simply wait for the next code and enter it immediately.
Fix 3: Type the Code Manually
Auto-fill or copy-paste can sometimes introduce hidden characters or spaces. Type the 6-digit code manually, digit by digit.
Fix 4: Confirm You're Using the Right Account
If you have multiple accounts in your authenticator app, it's easy to accidentally use the code for the wrong one. Verify the issuer name and account label match the service you're logging into.
Fix 5: Remove All Spaces
Some services require the code as 6 continuous digits (e.g. 123456), while others accept it with a space (e.g. 123 456). If one format fails, try the other.
Fix 6: Reconfigure the Authenticator
If codes are consistently wrong despite a synced clock, the secret key may have been set up incorrectly. Go to the service's security settings, disable 2FA, and re-enable it scanning a fresh QR code.
Fix 7: Use a Backup Code
If you still cannot log in, use one of your saved backup codes. Most services provide 8–10 backup codes when you first enable 2FA. After using a backup code, consider reconfiguring your authenticator.
Understanding TOTP Time Sensitivity
Time-based one-time passwords (TOTP) depend critically on the synchronization between your device's clock and the server's clock. The TOTP algorithm divides time into 30-second intervals. Both your authenticator app and the server calculate which interval you are in, and both generate the same code for that interval. If your device's clock is off by even 30 seconds, you will be generating codes for the wrong time window.
Most servers implement a tolerance window that accepts codes from the immediately preceding and following intervals (effectively a 90-second window). However, if your clock drift exceeds this tolerance, every code you generate will be rejected.
Platform-Specific Time Sync Instructions
Android
- Open Settings → System → Date & Time
- Enable "Use network-provided time" and "Use network-provided time zone"
- In Google Authenticator: tap ⋮ → Settings → Time correction for codes → Sync now
- Restart your phone
iPhone
- Open Settings → General → Date & Time
- Enable "Set Automatically"
- If already enabled, toggle it off, wait 10 seconds, then toggle it back on
- Restart your iPhone
Advanced Troubleshooting
Multiple Authenticator Apps
If you have installed more than one authenticator app (e.g., Google Authenticator, Authy, and Microsoft Authenticator), ensure you are checking the correct app. It is possible you registered the account in a different app than the one you are currently checking.
VPN and Location Issues
Some services enforce geographic restrictions. If you are using a VPN that makes it appear you are logging in from an unusual location, the service may reject valid 2FA codes as a security precaution. Try disabling your VPN temporarily.
Browser Cache and Cookies
Stale session data in your browser can sometimes interfere with 2FA verification. Try clearing your browser cache or using an incognito/private browsing window.
Verify Your TOTP Setup
You can verify that your secret key generates correct codes using our browser-based 2FA code generator. This runs entirely in your browser with no data sent to any server, making it safe to test your setup.
Prevention Checklist
- Keep automatic time enabled on all devices
- Save backup codes for every service in a secure password manager
- Label entries clearly in your authenticator app to avoid confusion
- Scan QR codes instead of manually typing secret keys
- Register multiple 2FA methods where supported
- Periodically verify your setup by logging out and logging back in
Codes Work on One Device But Not Another
If your codes work in one authenticator app but are rejected from a second device, the second device almost certainly has a clock problem or a differently configured secret. Check the device's automatic time setting first, then use the app's built-in time correction feature if it has one — Google Authenticator offers "Time correction for codes" in its settings menu. If the secret was transferred by manually typing it, one extra or missing character would also cause permanent rejection, so re-scanning the QR code is the reliable fix.
Remember that each authenticator entry is independent: moving a secret to a new phone does not change what the old phone generates, but both devices must derive the same 30-second window from the same secret. When an entry works for most services but fails for a single account, that specific entry was likely mistyped, or the service is enforcing a stricter policy — for example accepting only the current code with no grace period, which makes borderline timing a visible problem.
Still Locked Out?
If none of these fixes work, contact the service's support team. You will typically need to verify your identity using your account email, recovery phone number, or government ID.
Why the 30-Second Window Can Feel Much Shorter
The code is valid for its full 30-second interval, but your experience of that window shrinks: you still have to read the digits, type them, and submit, and every network round trip eats more time. If the server uses a tight tolerance with no grace period, a code submitted in the final seconds of the interval can arrive after rotation and be rejected even though it was technically valid when you saw it.
The practical habit is to enter codes during the first half of the countdown. If your app shows a progress ring or a shrinking bar, wait for the refresh and type the new code immediately instead of racing the clock with the old one. For time-critical logins, copy-paste beats manual entry — but only when your app and device allow it without inserting extra characters.
Work Phones, MDM Policies, and Blocked Time Sync
Company-managed devices often lock the date and time setting behind administrator controls. If your employer's policy disables automatic time, every TOTP code generated on that phone will drift further out of sync, and the in-app time correction features will also be unavailable. Talk to your IT team about enabling network-provided time on managed phones that hold authenticator entries, or keep work and personal TOTP accounts on separate devices.
There is a second, quieter risk: a remote wipe of a managed phone erases its authenticator app and every secret stored inside it. Before installing an authenticator on a work device, check whether the app data is covered by the company's backup policy, and keep your own backup codes and transfer methods documented outside the device. Never rely on a corporate phone as your only 2FA device.
Organizing a Crowded Authenticator (20+ Entries)
The more entries your authenticator holds, the higher the chance of reading the wrong code under pressure. Rename entries with the full service name you recognise — "GitHub — work" instead of a cryptic identifier — and delete entries for services you have closed, because a dead entry is still a wrong-answer trap. Apps with search, folders, or alphabetical sorting make the largest lists manageable; if yours lacks those, group entries by prefixing service names with categories like "bank" or "mail".
Spend five minutes a month cleaning up: remove duplicates left over from re-enrolments, update entries whose account emails changed, and note the date you last verified each one. A tidy authenticator is not cosmetic — it is the difference between a confident login and a lockout caused by grabbing the neighbouring code.
Moving Your Authenticator to a New Phone Without Breaking Codes
When you upgrade phones, transfer the app rather than starting from zero. Google Authenticator offers encrypted transfer via QR codes between two phones on the same network, Authy and Bitwarden restore from their own encrypted backups, and several TOTP apps export an encrypted file you can import on the new device. Run the transfer, then compare a code between the old and new devices — identical digits mean the secret arrived intact.
Keep the old phone until every entry has been verified on the new one, and do not wipe it in the meantime; once the old device is gone there is no second chance if an entry was missed. If your app has no transfer mechanism, disable 2FA per service from a desktop session and re-enrol with fresh QR codes on the new phone — tedious, but it produces the same result and lets you print a fresh set of backup codes at the same time.