A Google security code fails for one of four reasons: it was never sent, it was sent but is wrong, it expired before you used it, or it arrived on a device you no longer control. If your google security code not working problem matches one of those, match your symptom to the failure mode, then apply the one fix that fits instead of trying everything at once.
Why is my Google security code not working? (Diagnose it in 60 seconds)
Almost every "google security code not working" case falls into one of three buckets: no code arrived, the code was rejected, or the code landed on a different device. Match your symptom below, then jump to the section that fixes it.
| Symptom | Failure mode | Fix |
|---|---|---|
| Phone stays silent, no SMS or email | Code not sent | Check signal, spam folder, resend limits |
| Code arrives, Google calls it wrong | Rejected code | Time sync or expired code |
| Code hits your old tablet or backup number | Wrong device | Update recovery phone or sign in from that device |
Step 1: Did a code arrive at all? If nothing shows up, the problem is delivery, not the code. Wait two minutes before requesting another; Google throttles rapid resends.
Step 2: Did it arrive but get rejected? A rejected code usually means it expired or your Authenticator clock drifted. Both are fixable in minutes.
Step 3: Did it arrive on a different device? Codes follow whatever recovery phone or email is on file. Google's 2-Step Verification documentation explains where those settings live, and Section 5 covers what to do when that device is gone.
Why is my Google security code not being sent to my phone?
If the code never arrives, the problem is almost always delivery, not your account. Work through the three failure modes below in order: SMS issues first, then email, then resend limits.
SMS codes: carrier and signal issues
Carriers block short-code texts more often than people expect, especially if you recently switched providers while keeping your number (porting can drop short-code routing for days). Check your signal first: one bar in a basement or elevator means the text may arrive late or not at all. If you changed your phone number and never updated it in your Google account, the code is going to a phone you no longer own, and no amount of resending will fix that.
Email codes: check spam and aliases
When Google emails a verification code, it often lands in spam or a promotions tab within seconds of sending. Search your inbox for "Google verification" rather than scrolling, and check any alias or forwarding address on the account, since forwarded mail can get filtered on the second hop. This is also where a screen assistant earns its keep: instead of tab-switching between your inbox and the sign-in page, a tool like answerplz reads the code from your screen and answers in context with one click, no copy-paste. If you want to see how that workflow compares with manually pasting your question into a chatbot, see answerplz vs copy-pasting into ChatGPT, and for a head-to-head with a similar overlay, see answerplz vs Crade.
Resend limits and waiting it out
Google throttles repeated code requests, and hammering the resend button can silence the channel for a while. Wait a few minutes, request one code, and use it immediately. If nothing arrives after that, switch channels entirely, from SMS to email or an Authenticator prompt, instead of retrying the same dead route.
Why does my Google Authenticator code keep saying it's wrong?
When a TOTP code gets rejected, it's almost always one of two things: the code expired before you hit submit, or the app is generating codes for the wrong time. Google's own guidance for "code is incorrect" errors points to syncing the app's clock as the first fix — see Google's Authenticator time sync help page.
The 30-second window problem
Each Authenticator code is valid for roughly 30 seconds, and servers allow a small grace margin. If you read the code, pick up your phone, type it on your desktop, and submit, you can land just outside the window. Generate a fresh code and enter it faster, or use a screenshot-and-answer overlay like answerplz to grab the code and get it into the sign-in field without the copy-paste delay.
Stale or duplicate account entries
If you re-added the same Google account twice, or an entry survived a phone migration, one copy may hold an old secret key. Delete duplicate entries, keep only the newest, and re-sync time in the app's settings. If codes still fail, the saved secret is probably outdated: remove the entry and re-enroll from your account's 2-step verification page.
How do I fix time sync issues that break Google Authenticator codes?
Authenticator codes are based on your phone's clock. If it drifts even a minute, Google rejects the code. The fix takes under a minute.
Fix time sync in Authenticator (Android)
Open the Google Authenticator app, tap the three-dot menu, then Settings, and tap "Time correction for codes." Select "Sync now." Wait for the confirmation, then try a fresh code.
Fix time sync in Authenticator (iPhone)
The iPhone version has no sync button. Instead, delete the account from Authenticator (long-press, then Delete) and re-add it with your QR code or setup key, making sure "Time-Based" is selected. Codes should match immediately.
Check your phone's system clock
Go to Settings and enable automatic date and time (Android: System > Date & time; iPhone: General > Date & Time). Manual clocks drift; automatic ones don't. Then generate a new code.
What should I do if I lost access to the phone receiving Google codes?
Try a device where you're still signed in
Open Google on a laptop, tablet, or browser where your account is still logged in. Many people have a signed-in Gmail tab or an old laptop that never logged out. From there you can update your phone number or approve the sign-in prompt directly. Check any secondary device before assuming you're locked out.
Use Google's recovery flow
Go to Google's account recovery page and follow the prompts, answering questions about your account history. Try recovery from a device and location you've used before, since that improves the odds of passing the checks. If you set up a backup phone number or a physical security key, use it at this step. Recovery can take days if Google needs to review your case, so start it as soon as you notice the problem. Google documents the full process on its Account Help pages, including what evidence speeds up a review.
Add a second verification method once you're back in
After signing in, add a backup phone number, register a security key, and download your backup codes. Store the codes somewhere offline. Two independent methods mean one dead phone never locks you out again. Print the backup codes rather than saving them as screenshots, because a screenshot folder syncs to the same cloud account you are trying to protect.
Put one copy in a drawer at home and, if you travel often, a second copy in a bag you carry. Update the recovery phone number the same day you change carriers or devices, since an out-of-date number is the single most common reason people end up in recovery in the first place. Finally, sign out of devices you no longer use so a stolen old laptop cannot approve future prompts. Fifteen minutes of cleanup now prevents the multi-day recovery wait later.
How do I sign in when my backup codes don't work either?
Backup codes usually fail for one of three reasons: you already used each one (they're single-use), you printed or saved them so long ago they're illegible, or you're typing the 8-digit code with a typo. Google's Account Help page on 2-Step Verification backup codes confirms each code works exactly once, so a "used" code looks identical to a "wrong" code.
Last-resort account recovery
If every code is spent or unreadable, go to Google's recovery flow from a device and location where you've signed in before. Answer the prompts about your account history and wait the review period it names. Recovery can take days, and there's no guaranteed outcome. Once you're back in, generate a fresh set of backup codes and store them somewhere you'll actually find them.
Why did my Google security code expire before I could use it?
Google security codes are short-lived by design: SMS and email codes typically stop working within a few minutes, and Authenticator codes rotate every 30 seconds. If you copy a code, get distracted, and paste it two minutes later, Google has already issued a newer one and rejects the old one.
The fix is to request a fresh code and use it immediately. Close the old message, hit "Resend code" or reopen Authenticator, and paste the current code within seconds. If you keep pasting stale codes from an old email thread, delete the thread first so you don't grab the expired one by habit.
How can I prevent Google verification code failures in the future?
Most code failures trace back to one thing: a single point of failure in your account. Google's own guidance on recovering an account you can't sign in to starts by checking what recovery options you set up beforehand, which tells you where to focus.
Add at least two verification methods
Keep a current recovery phone number and a recovery email on file. If one is unavailable, the other still works. Update the phone number the same day you change carriers or devices.
Consider passkeys
A passkey replaces the code entirely. You sign in with your device's fingerprint, face, or PIN, so there is nothing to expire, mistype, or wait for by SMS.
Keep backup codes somewhere real
Print your ten backup codes and store them in a drawer, not a screenshot folder. They work when your phone is dead, lost, or out of coverage.
Quick reference: which fix matches your failure mode?
Code never arrived? Check signal, resend after 60 seconds, then switch to email delivery. Code rejected? You likely retyped a digit wrong or grabbed an old text, so request a fresh one.
Authenticator rejected? Resync its clock in settings. Lost the phone? Fall back to backup codes or a signed-in device.
Code expired? Use it within the minute it's valid. Match your symptom to the fix above and you're back in, usually in under five minutes.