If you are seeing an "Invalid authentication code" or "Verification code incorrect" error when trying to log in, you are not alone. Two-factor authentication (2FA) code errors are among the most common account access issues, and in the vast majority of cases, they can be resolved quickly without contacting support.
This guide covers every known reason why 2FA codes fail and provides step-by-step solutions for each scenario. Whether you are using Google Authenticator, Authy, Microsoft Authenticator, or any other TOTP app, these fixes apply universally.
How TOTP Codes Work (And Why They Can Fail)
Time-based one-time passwords (TOTP) work by combining two inputs: a secret key shared between your device and the service, and the current time. Both your authenticator app and the server independently calculate the same 6-digit code using these inputs. If the code your app shows matches what the server expects, access is granted.
This means that if either the time or the secret key is different between your app and the server, the codes will not match — resulting in an "invalid code" error.
Most Common Reasons 2FA Codes Fail
1. Device Clock Is Out of Sync
This is the single most common cause of invalid 2FA codes. TOTP depends on your device's clock being accurate to within a few seconds of the actual time. If your phone's clock has drifted — even by 30 seconds — the code your app generates may already be expired or not yet valid from the server's perspective.
How to fix it:
- Open your phone's Settings → Date & Time
- Enable "Set time automatically" or "Use network-provided time"
- If already enabled, toggle it off and back on to force a resync
- Restart your phone after making the change
- In Google Authenticator: go to Settings → Time correction for codes → Sync now
2. Code Has Already Expired
Each TOTP code is valid for only 30 seconds. If you see a code with only a few seconds remaining on the countdown timer and try to enter it, the server may have already rotated to the next code by the time your request arrives. Network latency can make this worse.
How to fix it:
- Wait for a fresh code to appear (full 30-second window)
- Type the code quickly or use copy-paste if your app supports it
- Most services accept the previous code for a short grace period, but do not rely on this
3. Wrong Account Selected in the App
If you have multiple accounts in your authenticator app (for example, separate entries for Google, GitHub, and Discord), it is easy to accidentally read the code from the wrong entry. Each entry generates completely independent codes.
How to fix it:
- Carefully verify the account name and email shown next to the code
- Rename entries in your authenticator app for clarity (e.g., "GitHub — work" vs. "GitHub — personal")
4. Secret Key Was Entered Incorrectly
If you manually typed a secret key instead of scanning a QR code, even a single wrong character will cause every code to be invalid. Base32-encoded secrets contain letters A–Z and digits 2–7. Common mistakes include confusing the letter O with zero (0), or the letter I with the number 1.
How to fix it:
- If you still have the original QR code or secret key, delete the entry and re-add it
- Use our browser-based 2FA generator to verify that a secret key produces valid codes
- When possible, always scan the QR code rather than typing the key manually
5. 2FA Was Reset on the Service Side
If 2FA was disabled and re-enabled on your account (by you or by a support agent), the old secret key stored in your authenticator app is no longer valid. The service generated a new secret key, but your app still has the old one.
How to fix it:
- Delete the old entry from your authenticator app
- Go to the service's security settings and set up 2FA again with the new QR code
- Save the new backup codes
6. Using the Wrong Authenticator App
Some users accidentally set up accounts in different authenticator apps. If you enabled 2FA using Authy but are checking Google Authenticator (or vice versa), the code will not be there.
7. Server-Side Issues
In rare cases, the service itself may have a time synchronization issue or a temporary bug. This is uncommon with major platforms but can occur with self-hosted services or smaller websites.
Step-by-Step Fix Checklist
- Sync your device time (Settings → Date & Time → Automatic)
- Wait for a fresh code with full 30-second validity
- Verify you are reading the correct account entry
- If manually entered, verify the secret key matches exactly
- Try on a different device if possible
- If all else fails, use a backup code to log in and reconfigure 2FA
When to Contact Support
If you have exhausted all the fixes above and your codes still do not work, you may need to contact the service's support team. Before doing so, gather:
- The email address associated with the account
- Any backup codes you may have saved
- Proof of identity (the service may request ID verification)
How to Prevent Invalid Code Issues
- Keep automatic time enabled — Never manually set your phone's clock
- Save backup codes — Store them in a password manager or secure offline location
- Use QR scanning — Avoid manual secret key entry when possible
- Label your accounts clearly — Rename authenticator entries to avoid confusion
- Register multiple 2FA methods — Use a hardware key as a backup when available
Related Troubleshooting Guides
- Google Authenticator Not Working
- 2FA Code Expired Before Entering
- 2FA Codes Out of Sync
- Lost Phone — Can't Access 2FA
Final Thoughts
Invalid 2FA codes are almost always caused by device clock drift, expired codes, or mismatched secret keys. By systematically working through the fixes in this guide, most users can resolve the problem in under two minutes. The key takeaway: always keep automatic time enabled and save your backup codes when setting up 2FA.
What Your Error Message Is Trying to Tell You
Services phrase rejection in different ways, and the wording narrows down the cause. "Invalid code" usually means the time or the secret does not match. "Expired code" means you typed it after the 30-second window rotated — the code was valid, just late. "Too many attempts" means you have triggered a temporary lockout and further tries will only extend it. Some platforms add a hint such as "try again in 30 seconds", which is a timing problem, not a secret problem.
Match the message to the fix before touching anything. A wording like "incorrect code" after a fresh code with a full countdown points to the wrong secret or the wrong account entry, while "expired" points to typing speed. Reading the error text carefully prevents you from deleting and re-adding a perfectly healthy authenticator entry, which is the mistake that turns a 30-second fix into a day of recovery.
Traveling and Time Zones: Why Codes Fail Away from Home
TOTP always runs on UTC, so crossing time zones should not break your codes — provided your phone updates its timezone automatically. After a long flight, a phone that kept its old timezone is generating codes for a window that may be hours away from the server's window. Landing and finding every code rejected is a classic sign of this, and the fix is the same as everywhere else: enable automatic date, time, and timezone, then restart the phone.
Airplane mode can also prevent time resync on devices that only sync when a network is available. If you connect to airport Wi-Fi and codes still fail, toggle automatic time off and back on to force a fresh sync. Never "correct" the clock manually to match local time — manual offsets are the number one cause of codes that work at home but fail on holiday.
The 2-Minute Secret Key Test (No Login Required)
If you suspect the secret itself is wrong, you can test it without logging into anything. Enter the base32 secret into a TOTP generator — the 2faco browser tool works for this — and compare the code it produces with the code your authenticator app shows at the same moment. Identical codes mean the secret is fine and the problem is your clock or entry selection; different codes mean the entry contains the wrong secret.
Do the comparison twice across two 30-second windows to be sure, and keep the test offline. If the entry is wrong, delete it and re-scan the original QR code rather than editing characters one at a time. If the original QR is gone, disable and re-enable 2FA on the service to receive a fresh secret — then save the new backup codes before you close the settings page.
Lockout Policies: Stop Trying After a Few Failures
Every platform caps failed attempts, and the caps are lower than most people expect: crypto exchanges often lock after three to five failures, Google after ten, and some banking apps after two. Each failed try resets the clock on the lockout, so hammering the code box turns a five-minute fix into a thirty-minute wait — or a support ticket if the service escalates repeated failures to a full security review.
Lockouts are also an alarm. If codes fail on an account you rarely use, check your email for sign-in notifications and review recent sessions before assuming it is your clock. A string of failed attempts can mean an attacker is guessing your password and getting stuck at the 2FA step — which is exactly what 2FA is supposed to do. Change the password once you are back in, and keep trying only after you have fixed the underlying cause.