Why your 2FA code is not working
Last updated: 24 August 2026
A rejected two-factor code almost never means you typed it wrong. It usually means your device clock has drifted, and both you and the website are calculating from different moments in time. Here is how to confirm it, fix it in seconds, and get logged in.
Check my clock and fix my codes
Why a correct-looking 2FA code gets rejected
A two-factor code is not stored anywhere and not sent to you. Your authenticator and the website each calculate it independently, from two ingredients: your secret setup key, and the current time, rounded into 30-second blocks.
That second ingredient is the problem. If your device's clock is even a minute out of step with the website's, the two of you are calculating from different 30-second blocks. Both answers are perfectly valid arithmetic. They just do not match, and the website has no way to tell a clock problem from a wrong code, so it says the code is invalid.
This is not your mistake and not a broken app. Phones and laptops drift naturally, and a laptop that has been asleep, a phone that changed time zones, or a machine in a virtual environment can all end up seconds or minutes adrift without showing anything unusual on screen.
Fix it right now, in about ten seconds
You do not have to change any system settings to get logged in. Our generator can measure the drift and then compensate for it:
- Open the 2FA code generator and paste your setup key.
- Press Check clock in the header. It compares your device against internet time and reports the difference in seconds.
- If you are adrift, the badge changes to Synced and every code from that point on is calculated on corrected time — so the website will accept them even though your system clock is still wrong.
- Copy the code and log in.
Most online generators only tell you your clock is wrong. This one keeps working anyway, which matters when you are locked out and cannot easily change a managed computer's settings.
Fix the clock properly, so everything else works too
Correcting the clock itself is worth doing, because the same drift breaks other things quietly — certificate checks, calendar entries, log timestamps.
Windows 11 and 10
Settings → Time & language → Date & time. Turn on Set time automatically, then press Sync now under Additional settings. Check the time zone is right as well; a correct time in the wrong zone still produces wrong codes.
macOS
System Settings → General → Date & Time. Turn on Set time and date automatically. If it is already on, switch it off, wait a few seconds and switch it back on to force a fresh sync.
iPhone and iPad
Settings → General → Date & Time → Set Automatically. Toggling it off and on again forces a resync.
Android
Settings → System → Date & time → Set time automatically (sometimes called "Use network-provided time"). Google Authenticator also has its own repair option under Settings → Time correction for codes → Sync now, which corrects the app without changing your phone clock.
Linux
Run timedatectl set-ntp true, then timedatectl status to confirm the
clock is synchronised.
The other four causes, in order of likelihood
1. The code expired while you were typing
Codes live for up to 30 seconds, and if you start copying one with four seconds left it may die between your clipboard and the login form. Wait for the counter to roll over rather than submitting a code on its last breath. Our generator shows the next code alongside the current one and offers Copy next instead during the final five seconds, so you always paste a code with a full window of life left in it.
2. The key was mistyped or truncated
Setup keys are long and often written down by hand. Many tools quietly skip characters they do not recognise, which produces a confident, plausible, completely wrong code — the worst possible failure, because nothing looks broken. Ours rejects an invalid key and names the offending character instead. If it accepted your key, the key itself is fine.
3. The account uses a non-standard format
Most services use SHA-1, six digits and 30 seconds. A few use SHA-256, eight digits, or a 60-second interval. A tool that assumes the defaults will generate wrong codes for those accounts forever, with no warning. Ours reads the algorithm, digit count and interval from your key or QR code and applies them.
4. You are using the wrong account's key
If you keep several keys, it is easy to reach for the wrong one — especially when two accounts are with the same provider. Check the label attached to the key you are using.
If you are here because the app itself is the problem rather than the codes, see Google Authenticator alternatives.
If you are already locked out
When no code works and you cannot get in at all, the route back is not the authenticator:
- Backup codes. Most services give you a list of single-use recovery codes at setup. Any one of them logs you in without a 2FA code.
- Another signed-in device. A phone or browser still logged into the account can often be used to disable or reset two-factor authentication from the security settings.
- Account recovery. Every major service has a recovery process. Expect identity checks and a wait of anywhere from minutes to several days.
Once you are back in, save your setup keys somewhere durable. The key is the only thing that regenerates codes; a phone or a browser is just something that holds it. Keep a copy offline — paper in a drawer, or an encrypted password manager. Our tool can produce an encrypted backup file or a printed recovery sheet with a QR code per account.
Get a working code now
Paste your setup key, press Check clock, and copy a code that will be accepted.
Common questions
Why does my 2FA code say invalid when I typed it correctly?
Almost always because your device clock has drifted. A two-factor code is calculated from your secret key plus the current 30-second block of time, so if your clock is a minute out of step with the website's, both sides produce different but internally valid codes and the login is rejected. Correcting the clock, or using a generator that compensates for the drift, fixes it immediately.
How far off can my clock be before 2FA codes stop working?
Most services accept a code from the block before and after the current one, giving roughly a 30 to 90 second tolerance. Beyond that codes are rejected. A drift of two minutes or more will fail everywhere.
Does Google Authenticator have a time fix?
Yes, on Android. Open the app, go to Settings, then 'Time correction for codes', and choose Sync now. This corrects the app's internal offset without altering your phone's clock. The iOS version has no equivalent setting, so you correct the device clock instead.
Can I get a working code without fixing my computer's clock?
Yes. The generator on this site measures the difference against internet time and then computes codes on corrected time, so they are accepted even while the system clock remains wrong. This is useful on managed or work computers where you cannot change time settings.
My code is rejected on one site but works on another. Why?
That points to the key or its settings rather than the clock, since a clock problem breaks every account at once. The likely causes are a mistyped key, or an account that uses a non-standard algorithm, digit count or refresh interval that your generator is ignoring.
What if no code works and I am locked out?
Use one of the backup or recovery codes issued when you enabled two-factor authentication, sign in from a device that is still authenticated and turn 2FA off there, or start the service's account recovery process. Afterwards, store your setup keys offline so a lost device never locks you out again.