TOTP code not working? Check these steps.

1. Confirm the service and account

Personal and work accounts can have the same service name but different setup keys. Match the email address or label in the authenticator to the account you are signing into. A code from another account will not work.

2. Wait for a fresh code

A code copied near expiry may expire before you submit it. Wait for the countdown to reset, then copy the new code and submit it promptly. Preserve leading zeroes. Some services also reject a code that has already been used.

If iAuthIQ shows a refresh error or hides the code, check the internet connection and use “Try again.” If your session ended, sign in again. Installing the site does not make code refresh work offline.

3. Check the clock

TOTP depends on time. For authenticators that generate codes on your device, enable automatic date and time and verify the device clock. iAuthIQ generates codes on its server, so its server clock must be correct; changing your device clock will not repair a server clock problem.

If multiple iAuthIQ accounts fail while codes from another authenticator work, report the issue through the contact page. Do not share setup keys or recovery codes.

4. Check the setup format

iAuthIQ supports SHA-1 TOTP, six digits and a 30-second period. Eight-digit codes, different periods, other hashing algorithms and counter-based HOTP are not supported by the current implementation. Use an authenticator that supports the format required by your service.

5. Confirm enrollment was completed

Saving a setup key in an authenticator is only part of setup. Most services ask you to enter a generated code on their enrollment screen to activate 2FA. If enrollment was cancelled or a new key was generated later, an older saved key may no longer match.

While still signed in, follow that service’s official instructions to check its authenticator configuration. Do not turn off 2FA or delete working keys just to test a guess.

6. Use the service’s recovery process

If you cannot sign in, use a saved recovery code or another method the service offers. An authenticator cannot recover the original key from your email address. Account recovery is handled by the original service.

Avoid repeated guesses if the service is rate-limiting sign-in attempts. Follow the message it displays before trying again.

Before moving to another authenticator

Keep recovery codes and verify the new setup before removing the old one. Read our browser authenticator setup guide and security limitations to decide whether this setup fits your needs.