If you're new to two-factor authentication, seeing your code change every 30 seconds can be confusing — or even alarming. Is something wrong? Is someone accessing your account? No. This is exactly how it's supposed to work, and it's a fundamental part of what makes 2FA secure.
In This Guide
Why Codes Change Every 30 Seconds
The whole point of two-factor authentication is that each code can only be used once and only for a very short window. If codes never changed, an attacker who intercepted one code could use it indefinitely. If they changed every hour, an intercepted code would still be valid for up to 60 minutes — enough time for an attack.
30 seconds is the standard window defined in RFC 6238 (the TOTP standard). It's short enough that intercepted codes are almost useless, but long enough that you can read and type the code before it expires.
How TOTP Actually Works
TOTP stands for Time-based One-Time Password. When you set up 2FA, you and the service exchange a secret key — this is the string of letters and numbers (or QR code) you scan. This secret key never changes.
Your authenticator app then takes two inputs: the secret key and the current time (rounded to the nearest 30-second period). It runs these through a cryptographic hash function (HMAC-SHA1) and produces a 6-digit number. The server does the exact same calculation simultaneously. If your number matches the server's number, you're authenticated.
Because both sides know the secret key and use the same clock, they always produce the same code for the same 30-second window — without ever sending the code over a network. This is why TOTP works even when your phone has no internet connection.
The Countdown Timer
The ring or progress bar around your code in the authenticator app counts down the remaining time in the current 30-second window. When it reaches zero, a new code is generated for the next window.
Most authentication servers accept codes from the current and previous window (±1 period) to account for slight clock differences and network delays. So even if your code just changed, the old one might still work for a few more seconds.
You can see this in action with a browser-based 2FA tool — paste your secret key and watch the code change in sync with the timer, with no network requests involved.
When to Worry
The code changing is normal. What's not normal:
Codes that don't match what the service expects — this is usually a clock sync issue on your device, not a security problem. See our guide on fixing 2FA sync problems.
Codes that change at irregular intervals — if your codes seem to change at random rather than every 30 seconds, your app may be buggy or your device clock has significant drift. Try reinstalling the app or syncing your clock.
Being prompted for 2FA when you didn't try to log in — this could indicate someone is trying to access your account with your password. Change your password immediately and check your account's recent activity.
Practical Tips
Watch the timer before you start typing. If there are fewer than 5 seconds left, wait for the code to refresh — you'll have a full 30 seconds with the new code. Copy the code by tapping it in your authenticator app rather than typing it manually, which reduces errors and is faster. If you're entering codes on a desktop computer frequently, a browser-based generator keeps the code visible without switching between devices.
Why Codes Fail Even When You Type Fast
Your authenticator app and the server never compare codes directly — they compare values derived from time. If your phone's clock drifts near a window boundary, your app can be one window ahead of (or behind) the server, so you generate a code the server isn't expecting, even though you typed instantly. Fix it by enabling automatic date and time in your phone's settings, and in Google Authenticator use Settings → Time correction for codes to resync.
Why the Code Changing Makes It More Secure
Every 30-second code is a one-time password: useless after it's used or expires. A code captured through a phishing page, a keylogger, or network interception can only be reused for a few seconds. Constant rotation also means a stolen code can't be replayed later. And because codes are never sent over the network — both sides compute them from the same secret and the same time — there is no static credential to steal in transit. One leaked code can't unlock your account, no matter how many breaches your password appears in.
Frequently Asked Questions
Why do my codes fail even though I enter them quickly?
If your device clock is off, even a quickly entered code will not match what the server expects. Enable automatic date and time on your phone, or use the Time correction for codes option in Google Authenticator to resync.
Can I use the code from the previous 30-second window?
Most services accept the previous window's code for a short grace period to allow for clock differences and network delays.
Does the changing code mean my account is compromised?
No. Codes changing every 30 seconds is how TOTP works by design. It is only a concern if codes are rejected repeatedly or you receive sign-in prompts you did not request.
What if the timer is almost done when I open the app?
Wait for the countdown to finish and the code to refresh before you start typing. You will then have a full 30-second window with the new code.
What Happens at the Exact Moment the Code Changes
At the boundary between two windows, the old code does not simply vanish. Because servers accept codes from the current and previous periods (a ±1 grace window), the code you were looking at remains technically valid for a short overlap after the app displays the new one. In practice, the safest read of this moment is: if the timer is at zero or below a few seconds, use the new code that just appeared, not the one you were squinting at — the new code has a full 30 seconds ahead of it.
This also explains a quirk you may have noticed: occasionally the code does not visibly change at the moment the timer reaches zero, or it changes twice in a row. A different code in the next window is not guaranteed — the new code is an independent calculation, and about one time in ten it will begin with the same digits or even be identical to the previous one. That is normal TOTP behaviour, not a frozen app.
Why Two Devices Show the Same Code (or Different Ones)
If you have the same account on two authenticator apps — say, your phone and a tablet — they should display identical codes at the same moment. Both compute from the same secret key and the same time window, and the result is deterministic, so the codes matching is the expected outcome, not an error. Conversely, if your two devices show different codes, they are holding different secrets for the same account, which usually means you scanned the setup QR code twice in a way that generated a new entry, or you typed the key incorrectly on one device.
To check which one is right, enter a code from each device on the service's login page — one will work and the other will not. Then delete the broken entry and re-enrol it with the correct secret so you do not discover the mismatch during a real login. Whenever you copy a secret between devices manually, paste it into a plain text field first to check for leading or trailing spaces.
Thirty Seconds vs Sixty: Who Decides, and Does It Matter?
RFC 6238 sets 30 seconds as the recommended default but lets each service choose its own time step, and some do: you will occasionally see 60-second countdowns, typically from banks, government portals, and older enterprise systems. The app you use plays no role in the decision — it simply renders the countdown the service requested. You cannot force a longer window from the app, and trying to stretch it would reduce security: a 60-second window doubles the time a stolen or phished code stays usable.
The practical takeaway is to read the timer as the service configures it. If you move between services with different window lengths, the same habits apply: start typing on a fresh code, copy rather than type, and never submit a code that has less than a few seconds left, because the network round-trip can eat the rest.
Does the Rotating Code Cost Data or Battery?
No — and understanding why is reassuring. TOTP generation involves no network traffic at all: your app combines the stored secret with the current time and runs a hash function locally, which is why codes keep changing even in airplane mode with no signal. The computation is trivial, so the rotation has no measurable effect on battery life; the only power involved is the display staying awake while you read the code.
This is also why a browser-based generator behaves identically to an installed app: the code is computed in your browser from the same secret and the same clock, with nothing sent anywhere. If your installed app and a browser tool ever disagree at the same moment, the difference is clock synchronisation on one of the devices, not the method of generation.