Drıftstack docs
Docs

Two-factor sign-in paused after too many incorrect codes

You might be here because: “Too many incorrect two-factor codes for this account” · “two-factor sign-in is paused” · “Too many incorrect codes for this sign-in. Sign in again to retry” · “my 2FA code keeps saying invalid” · “locked out after entering codes” · “audit log says Two-factor sign-in paused”

Short answer

Nothing is permanently locked — wait the minutes the message names. Five wrong codes cancel one sign-in attempt (“Too many incorrect codes for this sign-in. Sign in again to retry.”); ten wrong codes in 15 minutes pause two-factor sign-in for 15 minutes.

Check first

  • Phone clock correct? Wrong time makes every code “invalid”.
  • Right account entry in the authenticator app? Old entries from a previous enrolment do not work.
  • Do you still have unused recovery codes? “Code is invalid. Try again or use a recovery code.”.

Likely causes and fixes

  1. “Too many incorrect codes for this sign-in. Sign in again to retry.” — 5 wrong codes on this attempt. Start sign-in again (password), then enter a fresh code.

  2. “Too many incorrect two-factor codes for this account. Two-factor sign-in is paused — try again in N minutes.” — 10 failures in 15 minutes; the pause lasts 15 minutes. Wait the stated time, fix the cause (clock, wrong entry), then sign in.

  3. “Too many incorrect two-factor codes after signing in with Google/GitHub/an email link. Two-factor sign-in with [that method] is paused — try again in N minutes, or sign in another way.” — the pause is per sign-in method. Sign in with your password instead, if you have one.

  4. “Your password was changed. Two-factor sign-in … is paused after too many incorrect codes — sign in with your new password in N minutes.” — the reset went through; wait, then sign in with the new password.

  5. You did not enter those codes. Someone else may be trying your account. The audit log records Two-factor sign-in paused. Contact support from the account email and say so; a person reviews it.

If it still fails

After the pause, if codes are still rejected, see Lost my authenticator app or recovery codes. Press Talk to a person in this chat (or open Help) and include: account email, the exact message, the sign-in method, and the time. Access recovery and suspected intrusion are handled by a person.