Should you enter the zero at the start of a verification code?

The first zero takes up a position too

Suppose an authenticator shows 012345. This illustrative six-digit string has six positions from left to right, including the initial zero. Entering only 12345 leaves one position out.

A verification code is not a quantity to read as an integer. Its configured length is part of its format, so keep the initial zero when one appears.

Converting the code to a number can lose its format

A numeric conversion discards the initial zero. For example, passing the string '012345' to JavaScript's Number() produces the number 12345. Turning that number back into text does not recover the original six-character length.

That describes a numeric conversion, not the behavior of every website field. If pasted text becomes shorter, compare what the field contains with the complete current code in your authenticator before assuming the account setup is wrong.

A published test vector starts with zero as well

Appendix B of RFC 6238 includes the eight-digit result 07081804. It uses the document's public test secret, SHA1, a 30-second step and T0 = 0 at Unix time 1111111109. The first zero belongs to that result.

This is an eight-digit historical test vector, not a current six-digit account code to enter on a real sign-in page. RFC 4226's reference implementation also prepends zeros until the specified length is reached.

Take the complete current code when you need it

In Authenticator Cloud, find the entry for the service and account you are using, then read its complete current code. Keep any initial zeros when copying or entering it, without routing it through a spreadsheet or another tool that converts it to a number.

If the field already contains an older code, check its contents before entering the new one. When digits are missing, return to the authenticator for the full code instead of guessing how many zeros to add. See the browser copy and fill guide for ways to retrieve a code.

• Use the complete length shown for that entry, not just the last few digits.
• Match both the service and account rather than choosing by a similar name alone.
• If the code gets shorter, check whether it was converted to a number along the way.

What if the complete code is still rejected?

An initial zero is one formatting check. If the complete code is rejected, follow the code troubleshooting steps to check the account, timing and completed setup before removing an existing entry.