Instagram Authenticator Code "Invalid": How to Avoid a Lockout

Here's how to fix an invalid code without getting locked out.

Last checked: 29 October 2026 against the sources listed at the end of this guide.

Keep a dated note of every screen you see, including the exact wording shown, before you press continue on any form. Keep a dated note of every screen you see, including the exact wording shown, before you press continue on any form.

#Why is my code invalid?

Authenticator apps such as Google Authenticator, Microsoft Authenticator or Duo work out a new six-digit code every 30 seconds from a secret key and the current time. Instagram's server does the same calculation. If your phone's clock is even a minute or two out, the two codes do not match and Instagram says the code is invalid. That is why automatic date and time fixes so many cases.

#How do I check the basics?

• On iPhone, go to Settings, General, Date and Time, and turn on Set Automatically.
• On Android, go to Settings, then Date and time, and turn on automatic date and time and automatic time zone.
• Check the label in the authenticator app. If you have more than one Instagram account, each has its own entry.
• Wait for a fresh code and enter it straight away rather than typing one that is about to change.

#What if I'm locked out?

1. Use a saved backup code.
2. Tap Try another way.
3. Use a device where you're still logged in.
4. Use instagram.com/hacked support if nothing works.

Backup codes are the safest way back in. Instagram's Securing your Meta Account with two-factor authentication page explains that you can get backup codes in Accounts Center when you turn on two-factor authentication. Each code works once. If you saved them in a notes app, a password manager or on paper, use one now.

If you have no backup codes, try logging in on a phone or computer where you are still logged in, then go to Accounts Center, Password and security, Two-factor authentication to change your method. If you are fully locked out, Instagram may offer other checks on the login screen, such as a code by text message if you added your number, or an identity check. Instagram's I Can't Log In page lists the options.

#Why can't I just remove two-factor?

Two-factor authentication exists to stop people who know your password from getting in. If Instagram let anyone switch it off without the code, it would protect nothing. That is why you can only change it while you are logged in, or after Instagram has checked that you are the owner.

#How do I set it up better next time?

• Save the backup codes the moment you turn on two-factor authentication, and keep them away from the phone itself.
• Add a second method, such as a security key or a mobile number, where Instagram offers it.
• Use an authenticator app that can back up or transfer accounts, and turn that option on.
• Keep the email address and phone number on the account up to date in Accounts Center.

#What common mistakes should I avoid?

• Repeated attempts in a row.
• Not saving backup codes.
• Deleting the authenticator app.
• Sharing codes with anyone.

If you are changing phones, move the authenticator to the new phone before you wipe or sell the old one. Many apps have an export or transfer option, or a cloud backup you have to turn on. Without that step, the codes stay on the old phone and the new one cannot produce them.

#How do I keep the account safe while I sort this out?

• Never share a login code, password or backup code with anyone, including people who say they work for Meta, the police or a recovery service.
• Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise.
• Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline.
• Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads.
• Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report.
• Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks.

#When It Is Safer to Get Expert Help

Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen.

AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision.

• You have lost the phone with the authenticator and have no backup codes.
• Instagram keeps rejecting codes even with automatic time turned on.
• You think someone else set up two-factor authentication on your account.
• The account is used for business and you cannot risk a lockout.