Short answer: If your authenticator codes are being rejected, the cause is almost certainly clock drift — your phone’s time is out of sync with the server’s. Open your phone’s date and time settings and switch on automatic network time. That fixes the large majority of cases. The remaining causes are an expired code, a duplicate entry in your app, a failed enrolment, or the wrong account selected.
1. Your phone’s clock is out of sync
This is the cause roughly four times out of five. TOTP codes are calculated from a secret key and the current time, divided into 30-second windows. If your clock is more than about 30 seconds off, you land in a different window and produce a different number. The code is mathematically correct — just for the wrong moment.
On Android: Settings → System → Date & time → enable Set time automatically. Google Authenticator also has its own Time correction for codes option under Settings, which syncs the app’s internal offset without touching your system clock.
On iPhone: Settings → General → Date & Time → enable Set Automatically. If it is already on, toggle it off, wait ten seconds, and toggle it back on to force a re-sync.
Clocks drift after long flights, timezone changes, battery deaths, and manual time edits. Our explainer on how TOTP codes work covers why the timing is so unforgiving.
2. The code expired while you were typing
Codes live 30 seconds. If you start typing at second 28, it may be dead before you press enter.
Wait for a fresh code to appear, then enter it immediately. Most servers accept the previous window as well, giving about a minute of real-world grace — but not always. Counter-based tokens behave differently again, as our TOTP vs HOTP comparison explains.
3. You have duplicate entries in your app
If you set up 2FA more than once for the same service, your app may hold two entries with the same label but different secrets. Only the most recent one is valid. The other generates codes the server has never heard of.
Look carefully at your account list. If you see the same service twice, test each entry — one will work. Delete the dead one only after you have confirmed which is which.
4. You are looking at the wrong account
Obvious, but common when you have two accounts on the same service — a personal and a work Google account, for instance. The labels look nearly identical in a long list.
Check the email address or username under the code, not just the service name.
5. The enrolment never completed
If codes have never worked for a particular account — as opposed to working and then stopping — the setup itself probably failed. This happens when you scan a QR code but close the page before entering the confirmation code, so your app saved the secret while the server did not activate it.
The fix is to disable 2FA on that service using a backup code or recovery method, then set it up again and complete the confirmation step. If the QR code refuses to scan second time round, use the setup key for manual entry instead.
6. You are entering a backup code as a live code
Backup codes are usually eight digits and often contain letters; live TOTP codes are six digits. They go in the same field on many sites, but a backup code that has already been used will be rejected. Each one works exactly once.
7. The service is having problems
Occasionally the fault is not yours. If your codes work everywhere else and fail on one site, check that service’s status page or social account before troubleshooting further.
A quick diagnostic
- All accounts failing, everywhere → clock drift. Fix your phone’s time.
- One account failing, others fine → duplicate entry, wrong account selected, or a failed enrolment.
- Worked before, stopped suddenly → clock drift, or 2FA was reset on that service.
- Never worked from day one → enrolment did not complete.
- Fails only sometimes → you are catching codes at the end of their window.
If nothing works and you are locked out
Use a backup code. Every service issues them at setup, and each one substitutes for an authenticator code once. If you saved them, you are three minutes from being back in.
If you did not save them, you are into account recovery — identity verification, and often a waiting period of several days. Our step-by-step guide covers the process for major services: how to recover accounts when 2FA is unavailable.
Once you are back in, do two things. Save fresh backup codes offline. And consider scanning future setup QR codes into a second authenticator app so you always have a working spare — the alternatives roundup covers apps that make this easy.
Frequently asked questions
Why do my codes work sometimes but not always?
You are likely entering codes near the end of their 30-second window. Wait for a new code and submit it straight away.
Does changing timezone break my authenticator?
No, provided automatic time is enabled. TOTP uses UTC internally, so your displayed timezone is irrelevant — only the underlying clock accuracy matters.
Will reinstalling the app fix rejected codes?
Almost never, and it can make things much worse. Reinstalling deletes your stored secrets. If you have no backup, you lose every account in the app. Fix the clock first. If you are unsure how those secrets are stored, start with our explainer on what an authenticator app actually is.
Can airplane mode cause code failures?
Not directly — codes generate offline. But without a network connection your phone cannot sync its clock, so drift accumulates over long offline periods.
Why does the same code work on one site and not another?
It should not — each account has its own secret and produces different digits. If you are copying one code across sites, you are using the wrong entry.
The bottom line
Check the clock first. It is unglamorous, it takes ten seconds, and it resolves most cases before you start suspecting anything worse. Then work down the list from most to least likely — and whatever you do, do not reinstall the app hoping it will help.
5 Responses