Chapter 3 of 6 / I cannot get in
The second factor code is rejected
The code is right there on the screen in front of you and the site says no. There is one cause that accounts for most of these and it has nothing to do with the account.
What it usually turns out to be
| Cause | How often | What settles it |
|---|---|---|
| Clock drift on your machine or your phone | Very common | Sync the time. Codes are generated from it |
| The code expiring while the page loaded | Common | Wait for a fresh one and submit immediately |
| Typing it after the window rolled over | Common | Same fix |
| A rate limit from earlier attempts | Occasional | Wait an hour |
| A copied page collecting codes | Uncommon and urgent | Check the address. See below |
The clock, in more detail
A time based code is a function of a shared secret and the current time in thirty second slices. If your device thinks it is three minutes later than the server does, every code you produce is for a slice that has already passed and every one is rejected. Nothing about that is visible from the login screen, and the codes look completely normal while it is happening.
- Check the device generating the codes, not the one you are browsing on, if they are different.
- Automatic time sync is usually on and occasionally wrong, particularly after a machine has been asleep.
- A drift of more than about a minute is enough to break it consistently.
The one rule with no exception
Never send a code to anybody, on any channel, for any reason. There is no verification process that involves reading one out, and a code handed over is used within seconds while it is still valid. If you have already done that, go to the page for it now rather than finishing this one.
If it stays rejected
- Sync the clock and try once with a fresh code.
- Rebuild the circuit, because a slow page can eat the whole window.
- Stop after three attempts and wait an hour.
- Then use the recovery material you saved at setup. This is what it was for.
If you never saved that material, this is the point where it becomes the problem rather than an oversight. Recovery without it is limited by design, because the alternative would be a way for anybody to take over an account by claiming to have lost a phone.
Checking the clock properly
- Compare the device generating codes against any reliable clock. A phone showing the right minute can still be seconds out in a way that matters.
- Turn automatic time sync off and on rather than trusting that it is working. It fails quietly after a machine has been asleep.
- Do this on the device with the codes, which is often not the device you are browsing on.
- Then try once. If a fresh code fails on a synced clock, the clock was not the problem and the rest of the page applies.