By Alex Carter, Editor at GetVerifyCode
"Enter a 6-digit login code generated by an authentication app" means the account has two-factor authentication set to an authenticator app, not text messages. The code isn't texted to you. Open the app you set up, such as Google Authenticator or Duo Mobile, find the entry for that account, and type the current 6 digits before they refresh.
Key facts
- Instagram's help says that when you turn on two-factor authentication, you choose either text message (SMS) codes or a third-party authentication app as your main security method.
- Instagram names Duo Mobile and Google Authenticator as examples of apps that can generate its login codes.
- Google's Authenticator help says you can still generate codes without an internet connection or mobile service.
- Google lists four checks for a code that doesn't work: it hasn't expired, it's for the right app or service, it's for the right account, and your device time is synced.
How to get the login code from your authentication app
The code lives on the device where you first set up two-factor sign-in. Nobody sends it to you, so waiting for a text won't help.
- Unlock the phone or tablet you used when you turned on app-based two-factor authentication.
- Open the authenticator app you linked, for example Google Authenticator, Duo Mobile or another code generator you chose.
- Find the entry for the account you're signing in to. Each entry is labelled with the service and usually your username or email.
- Type the 6 digits shown right now into the login screen. If the timer is about to run out, wait for the next code and use that one.
If you have several accounts on the same service, each one has its own entry and its own codes. Using the code from the wrong entry is one of the most common reasons a login fails. To understand how these rolling codes are made, see time-based one-time passwords (TOTP) explained.
If you don't remember which app you used, check the authenticator apps installed on your phone. Some apps, including Google Authenticator, can sync codes to an account, so signing in to that app on a new phone may bring them back. Google's help page covers that for its own app.
Why the 6-digit code isn't working
If the login screen says the code is wrong, work through Google's checklist for an incorrect code. It applies to most authenticator apps, not only Google's.
- The code expired. Codes change every few seconds, so a code typed just as it refreshes can fail. Wait for a fresh one and type it straight away.
- Wrong app or service. If you use more than one authenticator app, make sure you opened the one you linked to this account.
- Wrong account entry. Pick the entry that matches the exact account you're signing in to.
- Your phone's clock is off. Google notes that its app now uses your operating system's time setting, so turn on automatic date and time on your phone.
If the app shows no codes at all, Google says you may have been signed out of its app or saved the codes under another Google account. For a code from any service that keeps getting rejected, our guide to an invalid or expired verification code covers more causes.
Lost your phone or authenticator app? Backup codes and recovery
If the device with your authenticator app is lost, reset or replaced, you can't make new codes on it. Your options depend on what you saved when you set up two-factor sign-in.
- Backup codes. Many services give you a set of one-use backup codes when you turn on two-factor authentication. If you saved them, use one in place of the app code.
- Another method on a device you still have. If you also set up SMS or a second device, choose that option on the login screen.
- The service's own recovery flow. Instagram's help for locked-out accounts lists a login link sent to your email or phone, a support request, and for some accounts a video selfie to confirm your identity.
Use only the official recovery pages of the service. Never give a login code or backup code to anyone who contacts you offering to "recover" your account. A code you didn't ask for may mean someone else is trying to sign in, as our guide to a random verification code text explains.
Authentication app code vs SMS code
Both are one-time codes, but they reach you in different ways. Our guide to two-factor vs two-step verification explains where each fits.
- Authentication app code: made on your own device, never sent as a text, works offline, changes every few seconds, and is tied to the device or app account that holds it.
- SMS code: sent by the service to your phone number, needs mobile signal, and is usually valid for a few minutes. WhatsApp's 6-digit registration code is an example.
- Backup code: saved once in advance, each code works a single time, and it's your fallback when the app or phone is gone.
If a login screen asks for an authentication app code, a text message code won't work in its place, and a new phone number can't receive it.
Can a temporary number get an authentication app code?
No. Authentication app codes are generated on your own device, so no phone number ever receives them, and GetVerifyCode can't supply them. Don't use a temporary number as the two-factor or recovery number for Instagram, Facebook or any account you plan to keep, because you can lose access to that number later.
A temporary number only helps when a service sends a one-time sign-up code by SMS and you'd rather keep your personal number private, as covered in keep your personal number private. Top up your wallet from $1. Each number is priced live per service and country. You see the quote before you confirm, and if no SMS arrives in about 20 minutes, the unused credit returns to your wallet.
Some apps reject virtual numbers. Acceptance is decided by the app, not by us. Using a temporary number to protect your privacy, travel, or test your own app is generally lawful in many places, but laws differ by country and each app sets its own terms. Check both. Never use it for fraud, impersonation, or getting around a ban.
Related guides
- Time-Based One-Time Password (TOTP) Explained
- What Is Two-Factor vs Two-Step Verification?
- What Does OTP Mean? One-Time Passcodes Explained
- What Is a Verification Code? SMS Codes Explained
- How to Get a Verification Code Without a Phone
- Verification Code Invalid or Expired? How to Fix It
Need an SMS code for a new sign-up instead? Start on GetVerifyCode or check live pricing.
About the author: Alex Carter is the editor at GetVerifyCode. Alex tests SMS verification routes across services and countries and writes plain-language guides on receiving OTP codes safely.
GetVerifyCode is not affiliated with the apps named in this article. Follow each app's terms and local law.
FAQ
FAQ
Open the authenticator app on the device where you set up two-factor sign-in, find the entry for that account, and type the 6 digits it shows right now. The code is made on your device, so it never arrives by text.
The account may not be in that app, or the codes may be saved under a different app or account. Google says that if its Authenticator codes disappear, you may have been signed out of the app or saved them with another Google account.
Usually the code expired, came from the wrong app or account entry, or your phone's clock is out of sync. Turn on automatic date and time, wait for a fresh code, and type it straight away.
No. If you chose an authentication app as your security method, the login code comes from that app, not from a text message. A code sent by SMS only works when SMS is the method you picked.
Often, yes, if you saved backup codes or set up another method. Otherwise use the service's official recovery flow, such as Instagram's login link, support request or identity check.
