Signing in with two-factor authentication

With two-factor authentication on, signing in has two steps:

Prove it's you with one of your methods.

The second step

Shorter Loop opens the second step with your preferred method.

Authenticator app. Type the 6-digit code your app shows, then click Verify.

Two-factor authentication: enter the 6-digit code from your authenticator app

Security key or passkey. Click Use security key, then touch your key or use your fingerprint, face or screen lock when your browser asks.

Two-factor authentication: use your security key or passkey when your browser asks

Recovery code. Type one of your recovery codes. Each one works once. See Recovery codes.

Two-factor authentication: enter one of your recovery codes

Use another method

Under Other ways to sign in you see every other method you have, for example:

Use your authenticator app

Use a security key or passkey

Use a recovery code

Click one to switch. To pick which method appears first, see Manage your two-factor methods.

Not you? Sign in with a different account takes you back to the sign-in page.

After the second step

You land where you were going. Some examples:

If you opened a link to a page, you get that page.

If an app such as Claude asked to connect to your account, you return to its approval screen.

Right after you sign in, you may see the checkup or the passkey suggestion.

When a code is wrong

That code did not work. Check the time on your phone and try again.

What you see	What it means	What to do
That code did not work. Check the time on your phone and try again.	The app code is wrong, already used, or your phone's clock is off.	Wait for the next code. Check that your phone sets its time automatically.
That recovery code did not work. Check it and try again.	The recovery code is mistyped or was already used.	Check it against your saved list. Try another unused code.
Your security key or passkey was not used. Try again, or use another method.	The browser prompt was closed, timed out, or the key isn't on this account.	Click Use security key again, or pick another method.
… You have 1 try left.	This sign-in allows 5 wrong codes, and you have used 4.	Check the code carefully before you try again.
This sign-in has expired. Sign in again.	You used all 5 tries, or more than 10 minutes passed since your password.	You are taken back to the sign-in page. Start again.
Too many wrong codes. Wait 15 minutes and try again.	10 wrong codes in 15 minutes, across all sign-ins. Code checks on your account are paused.	Wait 15 minutes. We also email you about it, in case it wasn't you.
Too many sign-in attempts. Please wait a minute and try again.	Too many requests from your network in one minute.	Wait a minute.

On a phone

The second step works the same on a phone. The left-hand illustration is hidden to save space.

In dark mode

Signing in through company single sign-on

If your company signs you in through its identity provider (SAML or OIDC, such as Okta, Microsoft Entra ID or Google Workspace), you won't see this second step. Your identity provider already checks who you are, usually with its own second step.

Troubleshooting and questions

Your security log: every sign-in, and the wrong codes too

Signing in with two-factor authentication

The second step#

Use another method#

After the second step#

When a code is wrong#

On a phone#

In dark mode#

Signing in through company single sign-on#

Related#