Two-Factor CodesWhere to start
If a code is refused, start with the page on codes that do not work. To understand what the six digits are, read how TOTP works, with a calculation you can follow by hand. To choose between SMS, an app and a security key, read the comparison of methods, which uses NIST and CISA guidance.
This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.