Authenticator Code Not Working? Fix It Without Locking Yourself Out

The Short Answer

A rejected authenticator code is usually a mismatch between the account, the current time window, or the secret enrolled with the service. Start with checks that do not alter the account. Destructive fixes—deleting an entry, uninstalling the app, or disabling 2FA—belong at the end, after you have a verified recovery path.

Authenticator apps commonly use TOTP, a standard defined in RFC 6238. The app and the website independently calculate a short-lived code from the same secret and current time. They do not need to send the six-digit code to each other in advance.

Use This Fix Order

1. Confirm the website and account. If the authenticator lists several entries for the same service, match the username, email, tenant, or environment shown on the sign-in page.
2. Wait for a completely fresh code. A code entered as its timer expires may reach the server in the next time window. Let the next code appear, then enter it once.
3. Set device time automatically. On iPhone, open Settings → General → Date & Time and enable Set Automatically. On Android, use the system’s automatic date, time, and time-zone settings.
4. Restart the sign-in attempt. Refresh the real service page or begin a new sign-in so you are not submitting a fresh code into an expired challenge.
5. Distinguish a code from a push approval. A six-digit TOTP can work offline; a notification approval needs connectivity and may ask for number matching. Use the method named on the page.
6. Try an official alternate method. Choose a backup code, passkey, hardware key, verified device, or another enrolled factor under “Try another way.”
7. Repair enrollment only after access returns. From an authenticated security-settings page, remove the stale factor, enroll the replacement, confirm one code, and save new recovery codes.

Why Device Time Causes Wrong Codes

RFC 6238 recommends a 30-second time step as a balance between security and usability. If the phone and verification server calculate different time windows, they produce different results even when the shared secret is correct. A code generated at the end of a window can also expire while it is being typed.

Google’s current Authenticator help says to check that the code is for the correct service and account, enter it before it expires, and confirm that device time is correct. As of July 30, 2026, Google also notes that the old in-app time-correction setting is no longer available in version 7.0 because the app uses operating-system time.

Symptom-to-Cause Checklist

• Every account fails: suspect device time, a recent phone restore, or a system-wide app issue.
• Only one account fails: suspect the wrong entry, duplicate labels, or a server enrollment that changed.
• The code works only after waiting: the first attempt may have crossed the time boundary.
• No code is visible: check whether you are signed into the expected authenticator profile or whether the account was stored only on another device.
• No approval notification arrives: check connectivity and notifications; push approval is different from offline TOTP.
• A work account fails: the organization may require an administrator to reset MFA registration.

What Not to Delete Yet

Do not remove the authenticator entry, uninstall the app, erase the old phone, or regenerate recovery codes while it is your only visible route into the account. Those actions can remove evidence or invalidate a credential without fixing the server-side enrollment.

• Keep any trusted browser session open and use it to review security settings.
• Locate service-issued recovery codes; they belong to the account provider, not the authenticator app.
• Check another enrolled factor before changing the current one.
• For a new phone, follow our authenticator transfer guide while the old device is still available.

If Codes Broke After a Phone Change

Seeing an account name on the new phone does not always prove that the original TOTP secret arrived with it. A device backup, account sync, manual export, and a fresh QR-code enrollment are different transfer methods. Confirm which method your authenticator and account provider support before erasing the old device.

• Compare the old and new phone side by side. Matching codes at the same moment indicate that both hold the same enrollment.
• If only the old code works, keep that phone available while you enroll the new authenticator from the service’s security settings.
• If neither works, stop changing devices and switch to the provider’s recovery path.
• After the new code is accepted, remove the old factor from the service—not merely from the old app—and refresh the recovery codes.

When the Problem Is Push Approval, Not TOTP

Microsoft’s current Authenticator troubleshooting guide separates code problems from notification and network problems. Push approvals can fail because notifications are disabled, connectivity is interrupted, the app is outdated, the device is noncompliant, or an organization has changed its policy.

A useful diagnostic is airplane mode: a standard TOTP code should still appear, while a push request cannot arrive. Do not treat that test as a reason to disable security software or organization controls.

Recover Safely If the Code Still Fails

1. Open the service’s official sign-in page yourself; do not follow an unsolicited recovery link.
2. Select another enrolled factor or a single-use recovery code.
3. If already signed in elsewhere, add the new factor before removing the old one.
4. For a work or school account, contact the administrator through the organization’s verified support channel.
5. After access returns, remove stale entries, label accounts clearly, and generate a fresh recovery-code set.
6. Store recovery codes away from the phone and test one alternate sign-in path.

GitHub’s 2FA recovery documentation, for example, recommends keeping recovery codes and more than one authentication method. For a missing device rather than a rejected code, use our lost-phone recovery plan.

Prevent the Next Lockout

Name duplicate accounts clearly, keep device time automatic, save service-issued recovery codes, and enroll a second strong factor where the provider supports it. Read how TOTP and QR secrets work before rebuilding an enrollment.

When you want a clean iPhone home for multiple TOTP accounts, explore Authenticator App 2FA – Vats. Add one noncritical account first, confirm the code on the service, and save that service’s recovery method before moving the rest.