A code can look correct and still be rejected. Start with its timing and the account you selected, then check the key and settings. Changing random characters or trying many codes is unlikely to help.
1. Use a fresh code for the right account
Check the account name on the service you are signing in to. If you have personal and work accounts with similar names, make sure you opened the right saved authenticator. Labels help you choose an entry, but changing a label does not change the key behind it.
Wait for the timer to restart, copy the new code, and submit it promptly. Paste all the digits, including any leading zero. A code shown earlier in a screenshot or copied to your clipboard may be out of date. Do not use the generator’s public demo key for a real sign-in.
The receiving service decides which time windows it accepts. There is no universal guarantee that a code remains usable after its displayed timer reaches zero. TOTP validation and clock tolerance are discussed in RFC 6238, section 5.2.
2. Check the device’s date and time
For codes generated in your browser, 2FA Live ONLINE uses your device’s current time. Enable automatic date and time in the device’s system settings, let it synchronize, then generate a fresh code. Manually choosing a different time zone is not a reliable fix for an incorrect clock.
A shared-code page receives its current code from the server. If the timer stopped updating, check your connection and reload the page. If the page reports an expired or revoked link, changing your clock will not restore access: the sender needs to provide a new active link.
3. Confirm that this is still the correct secret
If you reset two-factor authentication at the original service, a key from the old setup may no longer work. An authenticator entry can keep generating numbers even after a service stops accepting that key. A moving timer proves that a calculation is running; it does not prove that the service recognizes the secret.
Compare the entry with the setup you actually completed. Do not delete your working authenticator or recovery options while troubleshooting. If you cannot access the original secret, follow the service’s own account recovery instructions instead of guessing a replacement.
4. Keep the original settings
A plain Base32 key uses this tool’s defaults: SHA1, six digits, and a 30-second period. A complete otpauth://totp/ link may specify different values. Use the complete link if your provider supplied one, and check the settings shown below the generated code. This tool supports SHA1, SHA256, and SHA512, six or eight digits, and periods from 15 to 120 seconds.
Do not shorten an eight-digit result to make it fit a six-digit field. Do not change an algorithm just because its name looks newer. The settings must match the account provider. HOTP links and proprietary approval prompts are different methods and are not supported by this generator.
If the generator rejects the input
- “Use a Base32 secret”: paste the setup key, not a password or the short verification code. Supported key characters are A–Z and 2–7; the parser ignores spaces and hyphens.
- “The secret is incomplete”: copy the full key again from the original setup. Do not add guessed padding or characters.
- “Only time-based (TOTP) authenticator links are supported”: confirm that the link starts with
otpauth://totp/, nototpauth://hotp/. - A browser security error: use the official HTTPS generator in a current browser. Do not bypass a certificate warning.
If it still does not work
Stop repeated attempts if the service limits sign-ins. Use a recovery method you already set up with that service, such as its backup codes or another approved sign-in method. For a Google Account, follow Google’s own two-step verification troubleshooting. Work or school accounts may need their administrator.
2FA Live ONLINE cannot reset another service’s second factor or unlock its account. Keep secrets, current codes, passwords, and share links out of public support posts.