Run This Checklist in Order, Not Randomly
An invalid 2FA code has a short, well understood list of possible causes, and the fastest way to a fix is checking them in probability order rather than guessing. This guide is deliberately service agnostic, whether the code is rejected on your bank, on Instagram, or on some obscure forum you signed up for years ago, standard TOTP works identically underneath, so the diagnosis is identical too. Work down the checklist below one item at a time, and stop as soon as one of them explains what you're seeing. (If you're specifically on Google Authenticator, our dedicated fix guide adds app specific steps on top of this.)
Checklist Item 1: Is Your Device Clock Off? (Check This First)
TOTP codes are computed from your secret key plus the current time, sliced into 30 second windows. A phone clock off by even a minute produces a code for the wrong window entirely, one that is mathematically correct for that phone's idea of the time and practically rejected by every server checking against real time. This single cause accounts for the large majority of invalid code reports across every service, so it deserves to be ruled out before anything else.
- Android: Settings, System, Date and time, enable automatic time and automatic time zone. Toggle both off and back on to force an immediate resync rather than waiting for the next scheduled check.
- iPhone: Settings, General, Date and Time, enable Set Automatically.
- Google Authenticator on Android carries its own independent sync on top of the system clock: app Settings, Time correction for codes, Sync now.
- Desktop authenticator apps: sync the computer's own clock (Windows: Settings, Time and language, Sync now; Mac: System Settings, General, Date and Time).
After fixing the clock, wait for a completely fresh code cycle before testing again, don't reuse whatever was on screen a moment ago. The full mechanics of why time drives everything here are in our time sync deep dive.
Checklist Item 2: Are You Reading the Right Entry?
Years of enrollments leave lookalike entries stacked in the same app. Check that both the label AND the exact username shown underneath it match the account you're actually logging into right now. The sneakiest version of this: you re-enabled 2FA on a site at some point in the past, which silently generated a brand new secret on the server's side, but the old entry is still sitting in your app, still generating codes that look completely plausible, and is completely dead. If you find two entries for the same service, test the newer looking one first, and delete whichever one consistently fails so it can't confuse you again next time.
Checklist Item 3: Did the Code Expire While You Were Typing?
Codes rotate every 30 seconds, and most servers accept only the current window plus, at most, the one immediately before it as a grace period. If the countdown ring in your app is nearly empty when you glance at it, and you then spend several seconds switching apps, typing, and hitting submit, you can easily burn through the acceptance window entirely, especially with even a small amount of clock drift stacked on top. Also worth checking if you're pasting rather than typing: some login forms silently reject "123456 " with an invisible trailing space copied along with the digits.
Checklist Item 4: Have You Failed Several Times in a Row? (Rate Limiting)
After a handful of consecutive failures, many services quietly reject even a completely correct code for several minutes as a brute force defense, without any visible message explaining why. If you've already tried five or six times, stop. Fix the clock issue first, wait a full ten minutes, and then attempt exactly once with a freshly generated code rather than hammering the login form repeatedly, which only extends the lockout window on some platforms.
Checklist Item 5: Has the Underlying Secret Diverged?
If a device with a verified, correctly synced clock still produces codes that a service rejects, the stored secret in your app and the secret the server holds have parted ways. This usually traces back to a partial re-enrollment: you started setting up 2FA again at some point, the server issued a new secret the moment you scanned that new QR code, but you never finished confirming it, or you kept the old app entry around out of habit. No amount of retrying fixes a mismatched secret, because the math is correct on both ends, it's just correct for two different keys. The only real fix is logging in through a backup code or another registered method, disabling 2FA completely, and re-enrolling from scratch, deleting every stale entry for that service as you go.
The mental model worth keeping: your app and the server each independently compute a code from the same two inputs, secret and time. A rejected code always means one of those two inputs disagrees between the two sides. Time is fixable in a settings menu in under a minute. A mismatched secret is fixable only by re-enrollment, never by patience.
Checklist Item 6: Is This Actually Standard TOTP At All?
A small number of services quietly diverge from the six digit, 30 second standard that most authenticator apps assume, and no amount of clock fixing helps if that's what's happening here.
- Steam generates its own five character alphanumeric codes through its dedicated Steam Guard app, standard TOTP authenticators simply can't produce them at all (see our Steam Guard guide).
- Some banks and financial platforms run proprietary apps or issue 8 digit codes rather than 6, and their setup page will say so if you look.
- Push based approval prompts, tap yes or no on your phone, are an entirely different mechanism with no typed code at all, don't confuse a missing push notification for a rejected code.
Locked Out Right Now? The Escape Ladder
- Backup codes saved at the moment you first turned on 2FA, the designed escape hatch for exactly this situation.
- Alternate methods registered on the account: a second device, a hardware security key, or an email or SMS fallback if one exists.
- An existing logged in session, an old browser tab, a tablet, a phone app that's still signed in, use it to reach security settings directly and reset 2FA from the inside.
- The service's own recovery flow, the slowest option, involving identity verification measured in days rather than minutes. Our recovery guide walks through the exact steps for the largest platforms.
Once you're back inside, re-enroll cleanly, store fresh backup codes the right way this time (storage guide), and write down the setup secret somewhere offline so this entire checklist becomes unnecessary the next time something changes.
A Quick Way to Isolate the Problem Yourself
If you want to know for certain whether the fault sits with your device or with a specific account's enrollment, generate a fresh test secret with our secret generator, add it to your authenticator app, and paste that same secret into our browser TOTP generator in a separate tab. If both sides show the same code at the same moment, your phone's clock and your app are healthy, and the problem is isolated to that one account's stored secret. If the codes disagree, the fault is in your device, almost always the clock, and no account level fix will help until that's corrected.
Frequently Asked Questions
The same app works fine for other sites but fails for just one. Why?
That single detail isolates the problem to that one entry. Your clock is fine, since other sites are accepting codes from the same app at the same time, so the secret stored for that one service is either stale or the service expects a nonstandard format. Re-enroll that one account specifically rather than troubleshooting the whole app.
All my codes fail everywhere at once. What does that mean?
That pattern points squarely at the clock: one shared input feeding every single entry in the app at once. Fix time sync following the steps above and every account should start working again from the very next code cycle, with no per-account action needed.
Can I actually verify my app is generating correct codes, or am I just guessing?
Yes, and it takes under a minute. Create a test secret with our secret generator, add it to your app, and compare the result against our browser TOTP generator using the same secret. Matching codes prove your app and device clock are both healthy, meaning the problem you're chasing lives specifically in that one account's enrollment.
Does reinstalling the authenticator app usually fix invalid codes?
Almost never, and it frequently makes things worse. Unless cloud backup or sync is explicitly enabled, reinstalling the app deletes every stored secret with no way to recover them. Reinstalling is not a troubleshooting step for invalid codes, clock sync or deliberate re-enrollment are the only real fixes.
Why do banks and financial sites seem noticeably stricter about codes than everything else?
Financial services commonly configure narrower time windows and tighter rate limits than social platforms or forums, so a small amount of clock drift that other sites happily tolerate gets rejected there first. The underlying fix is identical everywhere: correct automatic time, nothing bank specific about the solution.
