2FA Code Not Working? Fix TOTP Codes
This 2FA code not working guide covers the TOTP causes a user can check safely. A rejected authenticator code usually comes from time, secret, or configuration mismatch; check them in that order before using account recovery.
- TOTP-specific
- No bypass advice
- Clock-first checklist
- Provider boundary
Quick answer
What to do when a 2FA code is not working
Treat a “2FA code not working” message as a configuration check, not a reason to guess codes. First enable automatic date, time, and time zone on the device creating the code. Wait for a fresh code, confirm it belongs to the exact account, and try again near the start of the 30-second window. If it still fails, verify the shared secret and its algorithm, digit count, and period. When the original secret is missing or the account has been reset, stop testing and use the provider’s official recovery flow.
Five checks
Diagnose an invalid authenticator code in order
Work through this 2FA code not working checklist in order so each test isolates one cause.
1. Synchronize the clock
TOTP divides Unix time into fixed windows. A phone or computer can show a plausible local time while still being far enough off to calculate a different code. Enable network-provided time and the correct automatic time zone on both the authenticator device and any system used for comparison.
2. Use a newly rotated code
A code entered as its timer reaches zero may expire before the provider evaluates it. Wait for the next code and submit it promptly. Do not keep retrying an older value; most providers also reject reuse after a successful verification.
3. Confirm the exact account and secret
Similar labels can hide that the authenticator is showing a code for another account, environment, or issuer. A single changed Base32 character produces an unrelated sequence. If 2FA was recently disabled and enabled again, the old secret is almost certainly obsolete.
4. Match every TOTP parameter
The common defaults are SHA-1, six digits, and 30 seconds, but not every system uses them. A full otpauth URI records algorithm, digits, and period. Preserve that URI during authorized testing instead of guessing settings from the visible code alone.
5. Respect the provider boundary
A local tool can prove that a secret and code match mathematically. It cannot see whether the provider has disabled the enrollment, rejected a reused code, locked the account, or requires another factor. Use backup codes or provider support when local checks pass but login still fails.
Use the right tool
Generate, verify, or rebuild a QR?
For a 2FA code not working problem, choose the page that matches the missing piece. Use the 2FA code generator when you possess the secret and need the current code. Use the TOTP verifier when you have both a secret and candidate code and want to test their match. Use the QR code generator when you have an existing secret but need a scannable enrollment image. The secret key generator creates a brand-new enrollment and cannot repair an existing provider account by itself.
New device
Authenticator codes not working after a phone change
If the 2FA code not working problem began after a phone change, confirm the same secret and parameters reached the new device. Cloud restore, app transfer, and device backup behavior varies between authenticator products. Confirm every important entry individually before wiping the old phone. If the provider supports showing a new enrollment QR, complete its setup and test a code while you still have a working recovery path.
Do not email an enrollment QR to yourself or leave it in a general photo library. The QR contains the secret key; anyone who scans it can create valid future codes. If migration is incomplete and no authorized secret copy remains, provider recovery is the correct route.
Important limits
What TOTP troubleshooting cannot fix
A 2FA code not working message may come from account state that local TOTP troubleshooting cannot see. This guide cannot receive an SMS, reverse a secret from a short code, approve a push notification, bypass a second factor, or change account ownership. It also cannot guarantee that a provider accepts the same clock window as a local verifier. These are service or account-state decisions, not mathematical TOTP generation problems.
Never paste a password, backup code, session cookie, recovery phrase, or unrelated account credential into a TOTP tool. A legitimate TOTP calculation only needs the shared secret and configuration.
FAQ
2FA code not working FAQ
These 2FA code not working answers cover the failure modes that remain after the ordered checks above.
Why is my 2FA code invalid even when I typed it correctly?
The code can be typed correctly but still come from the wrong time window, secret, or TOTP configuration. Enable automatic time, wait for a new code, and confirm the account label. If possible, compare the full otpauth URI rather than guessing the algorithm, digit count, or period.
How do I sync time for an authenticator code?
Set date, time, and time zone to automatic on the phone and computer, then reconnect so the operating system can update its clock. Restart the authenticator if needed and try a newly generated code. A manual clock that looks close can still cross a TOTP window at the wrong moment.
Why did 2FA stop working after I got a new phone?
The new phone may not contain the same secret, or an export/import process may have skipped the account. Re-scan the provider’s current enrollment QR or use the authenticator’s supported transfer feature. Do not delete the old enrollment until a code from the new phone succeeds.
Can an old 2FA secret still work after I reset authenticator setup?
Usually no. Resetting or re-enabling authenticator-based 2FA normally creates a new shared secret and invalidates codes from the previous one. Update every authorized authenticator and protected server copy to the new enrollment, then remove obsolete QR images and backups.
What if the provider uses an 8-digit code?
Use the exact digit count specified by the provider or encoded in its otpauth URI. A six-digit calculation cannot match an eight-digit setup even with the same secret and time. Algorithm and period must also match, so preserve the full enrollment URI whenever possible.
Does this guide fix SMS verification codes?
No. This guide covers authenticator-app TOTP codes created from a shared secret. Missing SMS messages involve carrier delivery, phone numbers, spam filtering, roaming, or provider infrastructure. Use the account provider and mobile carrier’s official troubleshooting steps for SMS failures.
Can I recover a lost secret from one TOTP code?
No. A short TOTP code does not contain enough information to reconstruct the long-lived secret. Use an enrolled device, saved backup codes, an approved secret backup, or the provider’s recovery process. Services claiming to derive a secret from one code are not offering a legitimate recovery method.
When should I contact the account provider?
Contact the provider when the secret is unavailable, the account was reconfigured, backup codes fail, access is locked, or a correct local TOTP test is still rejected. Only the provider can inspect account state, replay protection, recovery eligibility, and service-specific policies.