What causes GitHub authenticator app codes to stop working?
If you are trying to log in to GitHub and the authenticator app code is rejected, the issue is usually not the app itself.
The problem is often a time mismatch, an outdated secret, a copied code error, or a change in your GitHub two-factor authentication setup.
GitHub supports time-based one-time passwords (TOTP) through apps such as Google Authenticator, Microsoft Authenticator, Authy, 1Password, and Duo Mobile.
These apps generate six-digit codes that change every 30 seconds, so even a small sync issue can make a valid code look wrong.
- Device clock drift
- Wrong account entry in the authenticator app
- Expired or previously rotated 2FA secret
- Using a backup code or recovery flow incorrectly
- Login attempt on a different GitHub account than expected
Check whether the code is for the right GitHub account
Start by confirming that the authenticator entry belongs to the same GitHub account you are trying to access.
Many users have multiple workspaces, personal accounts, or repeated entries from past 2FA setups, which makes it easy to read the wrong code.
Open the authenticator app and look for the label associated with GitHub.
If you have more than one entry, compare the account name or issuer details.
GitHub may also ask for the code during sign-in to a specific organization or enterprise account, so make sure you are not authenticating the wrong profile.
- Verify the username shown on the GitHub login page
- Check for duplicate GitHub entries in the authenticator app
- Confirm you are not using an old account from a previous device
Fix the most common problem: device time drift
Time sync is the most common reason a GitHub authenticator code is rejected.
TOTP codes depend on your device clock matching the server closely, and even a difference of a few seconds can cause failure.
Set your phone or tablet to automatically use network-provided time.
On iPhone and Android, enable automatic date, time, and time zone settings.
If your authenticator app includes a time correction feature, use it after confirming the system clock is set correctly.
How to correct time on Android
- Open Settings
- Go to Date and time
- Enable automatic date and time
- Enable automatic time zone if available
- Restart the authenticator app and try again
How to correct time on iPhone
- Open Settings
- Tap General
- Tap Date & Time
- Turn on Set Automatically
- Retry the GitHub login
Make sure the code is entered before it expires
Authenticator codes are time-sensitive.
If you wait too long after opening the app, the code may roll over before GitHub processes it.
This is especially common when switching between apps, copying the code manually, or waiting for slow page loads.
To reduce failures, enter the code as soon as it appears.
If the countdown bar is nearly finished, wait for the next code instead of submitting a code that is about to expire.
- Use the newest code available
- Do not pause during entry
- Avoid reusing a code from a previous 30-second window
Check whether GitHub is asking for a recovery code instead
Sometimes users think the authenticator app is failing when GitHub is actually expecting a recovery code.
This can happen if you changed phones, deleted the app, restored from backup, or removed the original 2FA secret.
GitHub recovery codes are different from authenticator codes.
They are one-time use backup codes created when you enabled two-factor authentication.
If the app entry is gone or the secret no longer matches, recovery codes may be the only way to sign in.
- Look carefully at the sign-in prompt
- Check whether GitHub offers “use a recovery code”
- Try a backup code only if the authenticator code is unavailable
Re-add GitHub to your authenticator app if the secret changed
If you reset two-factor authentication, moved to a new device, or reconfigured your account, the old authenticator entry may no longer work.
In that case, the displayed code will always be rejected because it is based on an outdated secret key.
To resolve this, sign in to GitHub using another recovery method if available, then remove the old authenticator entry and set up 2FA again.
During setup, scan the new QR code or enter the new secret key exactly as provided.
- Delete outdated GitHub entries from the app
- Generate a fresh 2FA setup in GitHub security settings
- Store the new recovery codes securely
Try a different authenticator app if the current one is failing
Although most authenticator apps use the same TOTP standard, app-specific issues can still occur.
A buggy version, corrupted local data, or a bad device backup can interfere with code generation.
If you still cannot get a valid code, try another trusted authenticator app on the same device or a second device.
Popular options include Google Authenticator, Microsoft Authenticator, Authy, 1Password, and Bitwarden.
If the new app works, the original app setup likely needs to be recreated.
- Install a reputable authenticator app
- Import or scan the GitHub secret again if possible
- Compare the new code with the old one to confirm consistency
Clear browser and session issues that affect GitHub login
Sometimes the code is correct, but the login session is stale or the browser is holding an older authentication state.
This can happen after repeated failed attempts, switching browsers, or opening GitHub in a private window with partial session data.
Sign out of GitHub, close the browser, and reopen a fresh session.
If needed, clear cookies for github.com and try again.
You can also attempt login in another browser or on GitHub Mobile to rule out a browser-specific issue.
- Sign out completely before retrying
- Clear GitHub cookies if the login loop continues
- Test with Chrome, Firefox, Safari, or Edge
Use backup methods if you are locked out
If the authenticator app code no longer works and you cannot re-enable 2FA immediately, GitHub may still offer alternative access paths.
These options depend on how your account was set up and whether you saved recovery information.
Available recovery options often include backup codes, a trusted device, passkeys, or a security key such as a YubiKey.
For organization-managed accounts, your GitHub Enterprise administrator may also have an account recovery process.
- Backup/recovery codes
- Passkeys
- Security keys using FIDO2/WebAuthn
- Trusted device sign-in
Prevent authenticator failures on GitHub in the future
Once access is restored, protect yourself from repeat lockouts by tightening your 2FA setup.
GitHub security is strongest when you have more than one recovery method and your device time stays in sync.
Keep backup codes offline in a secure place, add a second authentication method if supported, and verify that your phone automatically updates time and time zone.
If you migrate to a new device, transfer the authenticator entry carefully before removing the old phone.
- Save GitHub recovery codes immediately after setup
- Enable automatic time on all devices used for login
- Register a security key or passkey as a backup
- Review 2FA settings after changing phones
When to contact GitHub Support or your organization admin
If none of the above fixes work, the issue may be tied to account recovery, enterprise policy, or a security change on GitHub’s side.
Personal accounts may require GitHub Support, while managed workplace accounts usually require help from an organization owner or IT administrator.
Provide clear details such as the exact login error, whether recovery codes work, which authenticator app you use, and whether the issue started after a device change.
That information can help narrow down whether the problem is device-related, account-related, or policy-related.
- GitHub username or enterprise account name
- Authenticator app name and device type
- Whether the phone time is set automatically
- Whether recovery codes or passkeys still work