Two-Factor CodesAuthenticator code not working
A refused code is almost always a clock problem. The other causes are easy to rule out.
1. The clock of the phone is off
The code is a calculation from the time. If your phone is a minute off, its codes belong to different time steps from the server's. RFC 6238 says the verifier should allow at most one step of delay, so a difference of more than about 30 seconds can already fail. Turn on automatic date and time in the phone's settings and, in some apps, use the "sync time" option. You can see this in the tester: change "Clock difference" and watch the code change.
2. You typed it too late
A code lasts for its time step, usually 30 seconds. If the countdown is nearly over, wait for the next code. A server that allows one step of drift also takes the previous code for a short moment.
3. The wrong entry
Many accounts in one app look alike. Check the issuer and account name above the code.
4. The secret was typed wrongly
If you typed the secret by hand, Base32 allows only the letters A to Z and the digits 2 to 7. A character such as 0, 1, 8 or 9 is not valid and the tester says so. Spaces and dashes are ignored.
5. Settings differ
The server may use 8 digits, a 60-second step or SHA-256, and the app must use the same. Apps read these from the setup address. When you set up by hand, a mismatch gives codes that never work.
6. The server is out of step (HOTP)
For counter-based tokens the server's counter may be behind or ahead. The service has to resynchronize it: contact its support.
What to do if nothing works
Use a backup code or the recovery path of the service. See the page on backup codes and recovery.
Does a new phone need a new setup?
Usually yes: the secret lives in the app. Some apps can export or sync it. If you lose the old phone and have no backup, you need the service's recovery process.
Can the server fix a drifting clock?
RFC 6238 describes the server remembering how far off your device is and correcting for it, provided the drift is small.
Sources
- RFC 6238, section on validation and time-step size (rfc-editor.org/rfc/rfc6238)
- RFC 4648, Base32 alphabet (rfc-editor.org/rfc/rfc4648)
- RFC 4226 (rfc-editor.org/rfc/rfc4226), resynchronization
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.