Why Your Codes Get Rejected (The 30 Second Explanation)
A TOTP code, the six digit number Google Authenticator shows you, is computed from two ingredients: the secret key stored in your app, and the current time, rounded down to a 30 second step. Your phone runs that calculation itself, offline, and the server runs the identical calculation with its own copy of the secret and its own clock. Nothing is transmitted except the resulting six digits, so if the two sides land on the same time step, the codes match. If they don't, the code is rejected even though the app did nothing wrong. That single mechanism, not a bug, not a broken app, explains the overwhelming majority of "invalid code" complaints. (Full mechanics: our TOTP explainer.)
Below are the real causes in order of how often they actually show up in support tickets and forum threads, starting with the one responsible for the vast majority of cases.
Cause 1 (By Far the Most Common): Device Clock Drift
Phone clocks are supposed to sync automatically over the network, but that setting gets switched off more often than people realize, sometimes by a corporate device policy, sometimes by an app that changed it, sometimes by nothing more than a stray tap. Once automatic sync is off, the clock drifts silently. A minute of drift is enough to push you outside most servers' acceptance window, and a phone can drift a full minute in a matter of weeks without you ever noticing, because the lock screen clock still looks approximately right to the eye.
Fix it on Android
- Settings, System, Date and time.
- Enable both Set time automatically and Set time zone automatically.
- If they were already switched on, toggle each off and back on. This forces an immediate resync with the network time server rather than waiting for the next scheduled check.
Google Authenticator on Android also carries its own independent correction, separate from the phone's system clock: open the app, tap the menu, Settings, then Time correction for codes, Sync now. This exists specifically for situations where you can't or don't want to change the system clock, and it fixes the app's internal calculation directly.
Fix it on iPhone
- Settings, General, Date and Time.
- Enable Set Automatically. If it's already enabled, toggle it off and on to force a fresh sync.
- If the toggle is greyed out, a Screen Time restriction may be locking it. Check Settings, Screen Time, Content and Privacy Restrictions.
After fixing the clock on either platform, don't reuse the code currently on screen, it was computed under the old, wrong time. Wait for the next 30 second cycle and use the fresh one.
Cause 2: You're Reading the Wrong Entry
This sounds too simple to matter, but it causes real lockouts. Authenticator apps accumulate entries over years of enrolling and re-enrolling accounts, and "Google", "Google (work)", and a leftover "Google (old)" from three years ago look nearly identical in a scrolling list. Before assuming your app is broken, confirm that both the account label and the exact email or username shown underneath it match the account you're actually trying to log into. The trap that catches the most people: if you ever disabled and re-enabled 2FA on a site, the server generated a brand new secret at that point, but your app may still be showing the old entry alongside the new one, and the old entry keeps generating codes that look completely normal and are completely dead. Clean these up as you find them so the next lockout doesn't repeat.
Cause 3: The Code Expired Between Reading and Typing
Every TOTP code lives for exactly 30 seconds, and most servers only extend a small grace window, typically the immediately previous code, on top of the current one. If you glance at a code with the countdown ring nearly empty, then get distracted flipping back to the browser tab, typing it out, and hitting submit, you can easily burn through those 30 seconds and land in rejected territory, especially if your clock also has a few seconds of drift stacked on top. The habit that fixes this permanently: if the countdown is in its last few seconds when you look at the app, wait for the fresh code rather than racing the old one.
Cause 4: Migrating to a New Phone Without a Proper Transfer
This is the cause people run into least often but that causes the worst panic when it happens, because every single code fails at once and it looks like the whole system broke. What actually happened is that your Google Authenticator entries never made the trip to the new phone. Older versions of the app had no backup at all, entries lived only on that one device. Newer versions sync via your Google account, but only if that setting was turned on before the old phone was lost, wiped, or traded in. The fix depends entirely on what you still have access to:
- Old phone still works: use its built in export feature (menu, Transfer accounts) to move every entry across in one pass. Full walkthrough in our transfer guide.
- Old phone is gone, but sync was enabled: simply sign into the same Google account inside the app on the new phone and the entries repopulate.
- Entries are gone entirely, no sync, no old phone: use each affected site's backup codes to log in, disable 2FA, and re-enroll fresh on the new phone. The full recovery sequence is in our lost device guide.
An authenticator entry is nothing more than a stored secret plus a math formula. If a healthy, correctly time-synced phone is still producing codes the server rejects, the stored secret itself no longer matches what the server has on file, and no amount of retrying fixes a mismatched secret. Re-enrollment is the only real cure at that point.
Cause 5: An Outdated App Version With a Sync Bug
Occasionally a specific version of Google Authenticator ships with a bug in how it handles its internal time correction, particularly after a major update to the phone's own operating system. Symptoms usually look like intermittent failures that come and go rather than a hard, permanent break. If you've ruled out clock drift and wrong entries and codes are still unreliable, check the Play Store or App Store for a pending update, and if one exists, install it before troubleshooting further. This is a rare cause compared to the first two, but worth ruling out quickly since the fix takes thirty seconds.
The Rarer Causes Worth Knowing About
- Wrong code length or type: A handful of services don't use standard six digit TOTP at all. Steam generates its own five character codes through its dedicated app (see our Steam Guard guide), and some banks issue 8 digit codes through proprietary apps. Check what the site's own setup page says it expects before assuming your authenticator is at fault.
- Duplicate enrollments: Scanning the same setup QR code into two different apps during setup can leave only the last confirmed enrollment valid, depending on how that particular service handles re-scans.
- Server side outages: Rare, but real. Sites occasionally have 2FA specific outages separate from the rest of the service. Check the status page before spending twenty minutes blaming your phone.
- A mistyped manual secret: If you originally typed the Base32 secret in by hand at setup instead of scanning a QR code, and codes have never once worked correctly, one mistyped character is almost certainly the cause. Delete that entry and re-enroll by scanning the QR code instead. What that key format actually is: our Base32 explainer.
A useful diagnostic for anyone comfortable with a bit of self testing: paste a test secret into our browser TOTP generator and add the same secret to your phone's app. If the two ever disagree on the current code, you've proven the fault lives in one of the two clocks, not in the account or the secret itself.
Locked Out Right Now? The Escape Ladder
If you need in immediately and don't have time to diagnose, work down this list:
- Backup codes: the single use codes generated when you first turned on 2FA. Check your password manager and any screenshot folders.
- Alternate registered methods: a second device, a hardware security key, or, if enabled, an SMS fallback.
- Still active sessions: a browser or app that's already logged in can often reach account settings and disable, then re-enable, 2FA from the inside.
- The account recovery form: the slowest path by far, identity verification measured in hours to days rather than minutes, but it works when nothing else does.
Once you're back in, re-enroll 2FA cleanly on the working device, save fresh backup codes the right way this time (how), and delete every dead entry from the app so this doesn't happen again the next time you upgrade phones.
Frequently Asked Questions
Why did my codes work fine for years and then suddenly stop overnight?
Almost always clock drift finally crossing the rejection threshold. Phone clocks wander slowly and invisibly when automatic sync is off, and the failure only becomes visible once the accumulated error crosses roughly a minute. Turning automatic time back on and forcing a resync ends the mystery permanently, and it won't recur as long as that setting stays on.
Does Google Authenticator need an internet connection to generate a code?
No. Code generation is entirely offline, it's pure math running on your phone. Internet only matters for the optional cloud sync of your entries between devices. If codes fail while your phone is in airplane mode, that rules out connectivity and points straight back at the clock.
The site says "code already used". What is actually happening?
Most servers accept each valid code exactly once, as protection against someone capturing and replaying a code. If a login attempt glitched and you resubmitted the identical code, the server correctly refuses it as already spent. Wait for the next 30 second code and submit that one instead.
Can I fix the drift without turning on automatic time, because I need manual time set for another reason?
On Android, Google Authenticator's built in "Time correction for codes" feature syncs the app's internal clock independently of the phone's system time, which exists precisely for this situation. On iPhone there's no equivalent per app override, so your options are setting the system clock as accurately as possible by hand or switching to a different authenticator app that offers its own internal correction.
Does this same clock problem affect Authy, Microsoft Authenticator, and other apps too?
Yes. Every TOTP based authenticator app depends on the identical clock and secret math, Google Authenticator isn't special in this respect. All the fixes above apply across apps, though whether an app offers its own internal time correction feature varies by vendor. Our general troubleshooting guide covers the cross service version of this same diagnosis.
