Troubleshooting

What to do when codes are rejected, filling does not work, the vault will not unlock, or an import fails.

A site rejects the code

Work through these checks in order.

1. Check the clock

Codes depend on the time. If your computer's clock is off by more than a minute or so, the site rejects every code.

Open Settings → "Clock check". Make sure "Compare with internet time when the authenticator opens" is on, then select "Check now".
Read the result. "The clock is accurate (difference N s)." means the clock is fine. "The clock is off by N s." means it is not. Small differences are corrected for you ("Codes use the measured clock offset."). For a large one you see "The difference is too large to correct. Fix the device time."
In that case, turn on automatic date and time in your operating system and try again.

The check asks time.akamai.com, timeapi.io, and cloudflare.com for the current time. The requests contain no account data, and these services can see your IP address. If you turn the check off, Popout uses the device clock as it is ("Off. The device clock is used as is."). If it cannot reach the servers, you see "Could not check. The device clock is used as is."

2. Check the account settings

A correct clock can still give wrong codes if the account was saved with different settings than the service uses. Compare the type, algorithm, digits, and period ("Period (seconds)") with what the service showed when you set it up. If you just added the account, select "Codes not matching?" → "Check settings", compare with your phone app's code, and pick the combination that matches ("SHA-1 · 6 digits" style). See Getting started.

3. Use the current code

Wait for a new code, or use "Copy next code" when the old one is about to expire.

Filling does not work

Popout fills codes into pages whose address it can check. See Fill codes into sign-in pages for the full steps. Common causes:

Site access is missing. You see "Permission to fill on this site is missing. Allow site access, or open the extension from the browser toolbar on the target site and try again." Select "Allow filling on example.com" (with the site's own address) in the prompt.
The page is not https. "Codes are not filled on pages without a secure (https) connection." The exceptions are localhost and 127.0.0.1.
The code field is inside a frame from another site. The frame's address must be secure and must be a saved site for the account, or you see "This site is not saved for this account. Check the address and try again." Use "Fill once" or "Remember and fill" when the address is right.
The vault is locked. "The vault is locked. Unlock it and try again."
The page cannot be filled (for example a browser page): "Codes cannot be filled on this page. Try again on the site where you want to sign in."
The field was not detected. Popout then copies the code: "Could not find an input field, so the code was copied. Paste it on the site." Click the code field once and try again, or paste the code yourself.

1.0.1 From version 1.0.1, filling no longer picks a phone-number field that has no sign of being a code field. If a code is not filled on such a page, click the real code field and try again, or copy the code.

A shortcut does not work

The fill shortcut is Ctrl+Shift+Y (Command+Shift+Y on a Mac). Other actions (scan a QR code on the screen, fill the best matching account, hide or show codes, open in a separate window) have no default key.

Open your browser's extension keyboard shortcuts page.
Find Popout Authenticator. Set a key for the action, or change the one that is there.
If another extension or the browser uses the same keys, choose a different combination.
Put the cursor in the code field before you press the key. Then check Filling does not work.

The right-click menu item "Fill 2FA code" does the same without a shortcut.

You cannot unlock

"The password is incorrect." Check the keyboard layout and Caps Lock.
Select "Unlock with a recovery code" and enter your recovery code. "The recovery code is incorrect." means a typo or an older code that was replaced.
You can also try "Unlock with passkey". In Firefox, passkeys are not available.

If you have lost the password and the recovery code, try a registered passkey. If none of the three works, the vault cannot be opened. See If you forget the password.

Import errors

These are the messages you may see when adding accounts from a file, links, or a QR image. For app-specific steps, see moving from other apps.

Message	What it means	What to do
"Unknown format"	The file is not a backup Popout recognizes.	Export again from the app, in a supported format.
"Export an unencrypted file from the Aegis app and use that."	The file is an encrypted export (the app name changes: Aegis, 2FAS, Bitwarden).	Export an unencrypted file from that app.
"This backup is encrypted. Enter its password." / "The password is incorrect."	The backup needs a password, or the one you typed is wrong.	Type the backup password in "Backup password" and select "OK".
"Could not read the file."	Popout could not open the file you chose.	Choose the file again, or export a new one.
"Could not read the link."	A pasted link is not a valid `otpauth://` link.	Paste one complete link per line.
"Only the first 500 links were imported. Paste the rest again."	Popout reads up to 500 links at a time.	Paste the remaining links in a second round.
"The secret key format is not valid."	Popout cannot read the secret key as typed.	Copy it again from the service, without extra characters.
"Digits must be a whole number from 6 to 10." / "Period must be a whole number from 1 to 3600 seconds."	A manual field has a value out of range.	Use the values the service showed.
"No QR code found." / "Not an authenticator QR code." / "Could not read the image."	The image has no readable sign-in QR code.	Use a sharper, larger image of the whole QR code.
"This is not a raw copy file." / "Could not open the copy."	The file is not a raw copy, or the password is wrong.	Check the file and the copy's password.

The side panel is missing

Open Settings → "Display" → "Open as". "Side panel" is listed when your browser provides a side panel. In Safari, a saved "Side panel" choice falls back to "Popup". Choose "Popup" or "Separate window" instead.

Sync does not show up

Open Settings → "Sync". The status line tells you why:

"Sync is off." Turn on "Sync with devices signed in to the same browser account".
"Set up a lock to sync your accounts with encryption." Turn on the lock, or "Allow syncing without a lock" (secret keys are then sent unencrypted).
"Locked, so it could not sync. Unlock first."
"Accounts were synced from another device. Merge them using the vault password set on that device."
"Not enough sync space." or "Checking data from another device. Try again shortly."

Select "Sync now" to try again. Firefox asks for permission first ("Firefox needs your permission to send encrypted accounts through Firefox Sync."). Safari shows "This browser does not support syncing between devices. Use a backup file to move your accounts to another device." Both devices must be signed in to the same browser account. More in Backup, export, and sync.

The vault cannot be read

If you see "Could not read the vault. Do not reset or remove the extension. Check the recovery options below.", open "Backup".

Select "Save raw copy" first, so nothing is lost.
Under "Restore from a snapshot", choose an earlier snapshot. In version 1.0.0, "Add missing accounts only" can fail while the current vault is damaged. "Restore entire list" replaces the current list with the snapshot.
In version 1.0.0, "Import from a raw copy" works only while the current vault can be read.

1.0.1 From version 1.0.1, importing a raw copy works even when the current vault is damaged.

Removing the extension also removes its accounts and snapshots. Save a backup file first.

Report a problem

Open an issue at github.com/elitekid/popout-authenticator/issues. Include your browser and version, the Popout version (Settings shows "Version"), what you did, and the message you saw. Do not post secret keys, recovery codes, or codes.