How TOTP codes work
TOTP stands for time-based one-time password. It is the six-digit code that an authenticator app shows and replaces every 30 seconds. The method is defined in RFC 6238, which builds on the HOTP method in RFC 4226.
When you turn on two-step sign-in, the site creates a random secret and shows it to you as a QR code or as text in base32. Your app stores a copy. From then on, the site and your app each compute the code on their own, from two inputs: the shared secret and the current time. The time is cut into steps, usually 30 seconds long, and the step number is the count of steps since 1 January 1970 UTC. The secret and the step number go through HMAC, usually with SHA-1, and the result is shortened to six or eight digits. Both sides get the same answer, so no code ever has to travel from the site to your phone.
Why a code is rejected
The clock is wrong
This is the most common cause. If the phone clock or the server clock is off by more than a step or so, the codes do not match. Most sites accept the step before and after as a courtesy, which covers about 30 seconds of drift, but not more. The clock check above tells you how far apart you are.
Digits or period differ
Some systems use eight digits or a 60 second period. If the app and the server disagree, you get a code that looks plausible and never matches.
A typing mistake in the secret
Base32 uses the letters A to Z and the digits 2 to 7. It has no 0, 1, 8 or 9, so a character that looks like a zero is the letter O, and a one is the letter I. The tool names the first bad character it finds. Spaces, dashes and lower case are fine.
SHA-1 against SHA-256
Some servers use SHA-256 or SHA-512, but many authenticator apps quietly use SHA-1 no matter what the setup link says. The two then agree on nothing. Try each algorithm above until one matches the code in your app.
How to fix the clock on your phone
Turn on automatic date, time and time zone. On iPhone that is under Settings, General, Date and Time. On Android it is under Settings, System, Date and time. A phone that was left in airplane mode for a long time, or one with a manually set clock, can drift by minutes. If your phone is correct and the server is not, tell the owner of the server to enable time sync with NTP.
Backup codes
When you enable two-step sign-in, most sites offer a short list of one-time backup codes. Save them in a password manager or print them and keep them somewhere safe. They are the way back in when a phone is lost, broken or wiped. Without them you depend on a slow account recovery process.
Moving to passkeys
A TOTP code is better than a password alone, but it can still be phished: a fake sign-in page can ask for the code and pass it on within its 30 seconds. A passkey cannot be handed to a fake page, because it is tied to the real address of the site. If a site offers passkeys, add one and keep the code app only as a fallback. Our passkey checker shows whether your device is ready. If you run your own web apps, the Gatekeeper card above adds passkey sign-in in front of them.
Frequently asked questions
Is it safe to paste my real TOTP secret here?
The page never sends anything: a content security policy blocks all network connections and there is no tracking. Even so, a secret is as sensitive as a password. Prefer a secret you are testing or about to retire, use a private window, and clear the box when you finish.
Why does my authenticator code not work?
The usual causes are a wrong clock on the phone or the server, a different number of digits or period than the site expects, a secret typed with a mistake, or an app that uses SHA-256 while the server uses SHA-1. Enter the code your app shows into the clock check above to see which one fits.
What does "off by about 30 seconds" mean?
Codes change every 30 seconds, so your app's code matches the code from the step before or after this device's current step. One of the two clocks is about one step out. Turn on automatic time on both devices, or on the server, and test again.
What does "not found within 5 minutes" mean?
The code your app shows does not match any code within ten steps either way. That is not a clock problem. The secret differs, or the digits, period or algorithm settings differ. Check the options above and retype the secret with care.
Can I paste an otpauth:// link instead of the secret?
Yes. Paste the full link, which is what a QR code contains. The page reads the secret, the issuer, the account, and the digits, period and algorithm if they are present, and fills in the options for you.
Which algorithm, digits and period should I use?
Almost every service uses SHA-1, 6 digits and 30 seconds, and most apps ignore other values in the setup link. Only change them if the service tells you to or the link contains them. Hardware tokens and some company systems use 8 digits, 60 seconds or SHA-256.
How do I fix the clock on my phone?
On iPhone, open Settings, General, Date and Time and turn on Set Automatically. On Android, open Settings, System, Date and time and turn on automatic date and time and time zone. On Windows or Mac, turn on automatic time and press the sync button. Some Google Authenticator versions also offer a time correction under Settings.
I lost my authenticator. What now?
Use a backup code if you saved one when you turned on two-step sign-in. If you have none, use the account's recovery process. Next time, store backup codes in a password manager, and consider a passkey, which does not depend on a code app.