Skip to main content

Cornell University

I'm Having Problems with My Hardware Token for Two-Step Login

Troubleshooting common problems with a Two-Step Login hardware token

This article applies to: Two-Step Login

On This Page

I'm trying to use a hardware token but no passcode appears when I press the token's button.

Solution: Either the battery is dead or the token is damaged. You will need to replace the token.

I received an "Incorrect Passcode" error message when I tried to enter the passcode from a hardware token.

There are three possible causes:

  • You mistyped the passcode displayed by the hardware token.

    Solution: Press the token's button again and enter the new passcode that appears.  
  • The token is not enrolled for use with your NetID.

    Solution: You can check whether you have enrolled a token by going to the Manage Your Two-Step Login site (link opens web app) and choosing the My Two-Step Devices tab. Any hardware tokens associated with your NetID will appear at the bottom of your list of devices, with the last two digits of the token's serial number.  
  • When a token's button has been pressed too many times without entering the passcode that is displayed, the token will "drift out of synch." This is similar to a cell phone that placed a call on its own from your pocket or backpack. A token can also "drift" when it is not used on a regular basis.

    Solution: You can fix the token by logging in with a passcode generated by the token three times in a row.
    1. At the Two-Step Login authentication prompt, press the token's button.
    2. Enter the passcode that is generated.
    3. Click Log In.
    4. Repeat this process with 3 different passcodes in a row. The fourth passcode should work.

If these steps do not fix the problem, contact the IT Service Desk.

The token displays something that is not a passcode.

If the token generates anything other than a passcode, it is considered defective. While Duo's policy is to replace a token up to 6 months after purchase, unfortunately, since the Cornell Store purchases tokens in bulk, by the time a person obtains one, the warranty has expired.

The only solution to a defective token purchased at the Cornell Store is to buy a new one or ask your department to replace the token.

Support Contact:

Cornell IT Service Desk

Normal Business Hours: Monday-Friday, 8am-6pm (Eastern Time)
Emergency Service Disruptions: After Hours Support


To share feedback about this page or request support, log in with your NetID

At Cornell we value your privacy. To view
our university's privacy practices, including
information use and third parties, visit University Privacy.