Find a useful next step without sharing your authenticator key

If a verification code is rejected

Start with the troubleshooting guide. Check that the device clock is synchronized, wait for a fresh time window, select the correct account, and confirm the originating website expects a supported TOTP profile. A six-digit number may look valid while belonging to a different account or a previous enrollment. An old seed stored in a second authenticator does not automatically become active just because its label matches.

If the original website has locked access after repeated attempts, follow that provider's official instructions rather than continuing to guess codes. Use its backup codes, a registered alternate factor, or account recovery procedure where available. 2FASync can calculate a number from an available seed but cannot override the service's verifier or issue new access rights.

If Google Authenticator import stops halfway

Read the Google import and QR security guides together. Keep the original authenticator active, check camera permissions or local image readability, and verify that all pages of a multi-QR batch were scanned from the same export. A preview can distinguish duplicates, invalid entries, and unsupported HOTP profiles. Do not replace a missing QR fragment with a different export or copy the entire migration payload to an outside decoder.

If an imported item shows the right name but a different number, check the original website enrollment and relevant profile details before deleting either copy. Another imported entry with the same label may have a legitimately different seed. Never share a readable export QR or setup URI to demonstrate the mismatch.

If the Vault is locked or appears to have missing entries

Google sign-in establishes your member identity, while the Vault requires a separate passphrase, matching recovery key, or approved device key to decrypt data. If the interface says a browser is not authorized, follow the member device-binding flow rather than creating a second unrelated Vault. If sync changes are pending or in conflict, review the exact state and avoid repeated imports that create duplicate copies.

For a lost phone or forgotten passphrase, read the lost-device and encrypted backup guides. A compatible locally saved encrypted backup can be opened with its corresponding recovery material even when the original Google account is unavailable. If both your seed copies and all recovery routes are gone, the original websites' own account recovery may be necessary.

Prepare safe diagnostic details

Make a note of the affected feature, expected versus observed result, generic error message, browser family/version, approximate time, whether the device was offline or resumed from sleep, and whether the issue occurred in guest mode or an unlocked member Vault. For a transfer, the number of expected and scanned QR pages can help identify a batch problem without revealing its contents.

Do not include passwords, Base32 keys, complete otpauth URIs, authenticator QR screenshots, live OTPs, recovery keys, session tokens, or decrypted Vault data. A real TOTP seed may continue authorizing codes long after the support conversation ends. When exposure is suspected, rotate the authenticator enrollment at the original website.

Support and security reports need verified destinations

These self-help guides are available without transmitting your secrets. The current 2FASync documentation and application source have not established a confirmed public support mailbox, operator contact form, legal mailing address, or help response schedule. We therefore do not provide an unverified address or a made-up support guarantee. An operator-approved support channel must be validated before live publication can represent it as official.

For a potential vulnerability, follow the responsible disclosure guide to prepare minimal sanitized reproduction details. A product question, Google account recovery problem, and an original website's 2FA enrollment issue are distinct cases; choosing the appropriate guide can resolve many problems without disclosing long-lived authentication credentials.

Can support reset the secret for my original website?

No. The original website controls its TOTP enrollment. Use that site's official account-recovery process if you lost every working authenticator and recovery factor.

What information is safe to share about an error?

Feature name, synthetic steps, browser version, approximate time and redacted error category are useful. Do not disclose real setup keys, QR payloads, live codes, passphrases or recovery keys.

Where is the official support email address?

The reviewed release materials do not yet identify an operator-verified public support inbox. Do not trust a guessed address; use self-help material until an official channel is published.