Invalid 2FA Code? Clock Drift and Other Causes, Fixed

What an Invalid 2FA Code Error Actually Means

You type in the six-digit code from your authenticator app, hit submit, and get rejected. Frustrating — but the error tells you something specific: at the moment you submitted, the code your app generated did not match the code your server expected.

Authenticator apps use TOTP, a standard that builds a fresh code every 30 seconds from a shared secret and the current time. Both sides — your app and the server — run the same calculation. When the codes line up, you're in.

A rejection means one of two things happened in that 30-second window:

• Your app and the server calculated different codes, usually because their clocks disagree.
• You entered the wrong code, or a code that had just expired.

The timing matters more than most people realize. If you read the code at second 29 and finish typing at second 31, the app has already rolled to the next code while you were mid-entry. A code that was correct when you looked at it is stale by the time you hit submit. Some sites accept the previous code as a grace allowance; many don't.

Here's the good news: the code itself is almost never broken. The shared secret in your app doesn't wear out or corrupt — it's just a static string of characters stored on your device. Most mismatches come down to timing or small entry mistakes, and both are fixable in minutes once you know where to look.

Clock Drift: The Number One Cause

TOTP codes aren't random. Your authenticator app generates them by combining your secret key with the current time, and the server does the same calculation on its end. The two sides never talk during login — they just trust that their clocks agree.

When they don't, you get the classic frustration: the code looks perfectly valid, but the server rejects it. Even a drift of 30–60 seconds can push your code outside the acceptance window, especially for services that only allow one time step of leeway. A typical TOTP code is only valid for 30 seconds, so a service that accepts one step before or after gives you roughly a 90-second window. Drift beyond that, in either direction, means rejection no matter how quickly you type.

Clocks drift for boring reasons. Phone clocks depend on a setting called automatic time sync, which can be switched off, fail silently, or lag after travel across time zones. Some devices also accumulate small errors over weeks simply because their internal quartz oscillators run slightly fast or slow. A phone that is 15 seconds slow today can be 40 seconds slow next month.

How to recognize it

• The code works on one device but fails on another.
• Codes fail only on one particular service.
• Your phone's time is visibly off, or time zone is wrong.
• Codes used to work, then started failing gradually over weeks.

A common mistake is blaming the service and requesting a new code repeatedly. If the timing is the problem, fresh codes fail too, because every code your app produces is anchored to the wrong time. Compare your phone's clock against a reliable source — most operating systems show network time on a lock screen or in settings — and note the difference. Even a minute matters. If any of these signs sound familiar, clock drift is almost certainly your culprit.

Fixing Time Sync on Your Devices

Authenticator apps generate codes from your device's clock. If it runs even a minute fast or slow, every code fails. TOTP codes rotate every 30 seconds, and most servers accept only the current window plus one before and after — so drift beyond roughly a minute reliably breaks every attempt.

Phones

Android: Settings > System > Date & time. Turn on "Automatic date & time" and "Automatic time zone." Restart the phone if these were off. A restart matters because some apps cache the clock offset and won't pick up the corrected time until relaunched.

iPhone/iPad: Settings > General > Date & Time. Enable "Set Automatically." Location Services may need to be on for time zone detection — if you travel across time zones with it off, the phone can show the right time while sitting in the wrong zone, which still breaks codes.

Common mistake: manually setting the clock to "about right" instead of using automatic sync. Manual clocks drift again within days.

Authenticator Apps

Google Authenticator (Android): Tap the three-dot menu > Settings > "Time correction for codes" > "Sync now." Codes generated after this should match the server. This fixes drift inside the app even when the phone's clock looks correct.

iOS: Google Authenticator has no separate sync option there — it relies on the system clock, so the iPhone fix above covers it.

Microsoft Authenticator: No manual sync exists. Correcting the phone's clock is enough.

Computers

Needed if you approve logins or enter codes on desktop:

Windows: Settings > Time & Language > Date & time. Enable "Set time automatically," then select "Sync now." Windows defaults to syncing only once a week, so manual sync is worth running when codes fail.

macOS: System Settings > General > Date & Time. Enable "Set date and time automatically."

Codes still rejected after syncing? Clock drift was not the cause — move to the next one.

Other Common Causes of Rejected Codes

If your clock is synced and the code is still rejected, check these four before blaming the app.

The Code Expired While You Typed

TOTP codes refresh every 30 seconds. If you start typing with only a few seconds left, the code expires before you hit submit. Check the countdown ring first; if it's nearly empty, wait for the next one instead of racing it. This matters most on slow connections: a submit button can take several seconds to process, so a code entered at the five-second mark may already be stale by the time the server sees it. A good habit is to wait for a fresh code, then enter it during the first fifteen seconds of its life.

Wrong Entry Selected

Authenticator apps often hold codes for many accounts, sometimes with similar names. The code for "Work Email" fails when the site asks about "Work Email 2." Read the account label carefully, especially right after adding a new entry. A common mistake is re-adding an account during setup and ending up with two entries, one old and one new, where only one is valid. If you see duplicates, delete the outdated one once sign-in works, or rename entries so each matches the site exactly.

Backup Codes vs. TOTP Codes

Backup codes are long, one-time recovery codes created during setup. They don't refresh every 30 seconds. One pasted into a 6-digit field always fails. Keep backup codes for the "I can't reach my app" situation, not daily sign-ins. Note that some sites ask for backup codes on a separate recovery page; using the wrong page is another frequent mix-up.

Copy-Paste Errors

Codes copied from messages, notes, or screenshots can pick up hidden spaces, line breaks, or an extra digit. Some login fields trim them silently; others reject the whole code. Typing it by hand avoids this. If the site supports paste, paste into a plain text editor first, remove stray characters, then copy again.

Resyncing or Re-adding the Authenticator Entry

If time sync fixes didn't help, or codes keep failing, the stored entry itself may be stale or corrupted. Removing and re-adding it gives your app a fresh shared secret. This happens more often than you'd expect: a partial scan, a truncated QR code, or an interrupted setup can leave the app with a secret that never matched the server's copy in the first place.

Before You Delete Anything

Never remove an authenticator entry without a fallback in place. First confirm you have at least one of:

• Backup codes saved somewhere safe
• A second device with working codes for the same account
• Another enabled factor, such as SMS, email, or a hardware key

If the new setup fails midway, you'll need one of these to regain access. Test the fallback too — a backup code you've never tried may have been saved incompletely. Generate a fresh set if you're unsure.

Re-adding the Entry

1. Sign in to the service and open its security or two-factor settings.
2. Remove or deactivate the old app-based 2FA method.
3. Choose the option to set up an authenticator app again. The service generates a fresh QR code.
4. In your app, delete the old entry, then scan the new code. Scan in good lighting and check the displayed account name matches before saving — a secret saved under the wrong label is easy to misjudge later.
5. Verify a newly generated code before closing the setup screen. If verification fails immediately, don't delete the old entry from any other device; the old secret may still be valid.

Some apps also offer a per-entry time correction option — check the app's settings before resorting to full removal.

When the Problem Is Not on Your Side

Sometimes your codes are correct, and the failure sits elsewhere.

Server-Side Issues

The service checks your code against its own clock and records. If the provider has a time-sync problem or an outage, even valid codes get rejected. Nothing you change locally will fix that. Check the provider's status page, wait a few minutes, then try one fresh code. A useful tell: if login fails on a completely different device and network at the same moment, the fault is almost certainly server-side, not yours. Do not keep retrying during an outage — failed attempts still count toward lockout counters on some services.

Account Lockouts

Repeated wrong codes often trigger a temporary lockout. Many services block further attempts for a set period after several failures — and each extra guess can reset the timer. Stop trying, wait out the lockout, then enter a single newly generated code. The common mistake is impatience: people wait half the lockout window, retry, and start it over. Set a timer for the full stated period. If no duration is stated, assume at least 15–30 minutes before the next attempt.

Changed Phone Number or Restored Device

If you changed your phone number or restored a device from a backup, the stored entry may no longer match what the server expects. SMS codes go to the old number, and restored authenticator entries can generate codes from an outdated secret. Sign in with recovery codes or the provider's account recovery flow, then re-enroll 2FA on the current device or number. Note that some backup restores carry over the authenticator app but lose per-entry icons and names — verify each entry belongs to the right account before trusting its codes, since a mismatched label is an easy way to submit the wrong account's code.

Troubleshooting Checklist and Prevention

When a code gets rejected, run through these checks in order:

1. Check time sync. Compare your device's clock with a reliable time source, such as time.gov or another device you trust. Even a minute off can invalidate TOTP codes, because the server and your app must agree on the current time window. A phone with "automatic date and time" switched off after travel is a classic culprit.
2. Confirm the right entry. Saved accounts look alike in authenticator apps—two entries named "Alex" for different services, or duplicates created during re-setup, are easy to mix up. Check the full account label and issuer name, not just the first few characters. Copying the wrong code for the right site wastes a full 30-second window.
3. Use a fresh code. Codes expire every 30 seconds. Wait for the countdown to roll over and enter the new one. Retrying an old code is the most common self-inflicted failure, especially when typing six digits takes longer than the remaining seconds.
4. Try a backup code. If codes keep failing, a saved backup code gets you in so you can fix the authenticator entry calmly instead of rushing while locked out.

Preventing future problems

• Enable automatic time sync on every device your authenticator runs on, so clock drift never returns. Recheck after system updates or timezone changes.
• Store backup codes offline—printed or in a secure spot—before you need them, not after. A screenshot in your phone's gallery defeats the purpose if you lose that phone.
• Prefer app-based 2FA or hardware keys over SMS. They don't depend on cell coverage and are far harder to intercept.

Most 2FA failures come down to time or the wrong entry. Fix those two, keep backups handy, and rejections become rare.