Why Is It So Hard Just to Log In to ChatGPT?
When security gets so complicated that legitimate users can’t access the service, something has gone wrong with the login experience.
I normally use ChatGPT on my PC.
I have several Projects in ChatGPT, and sometimes I want to check something from one of them while I’m away from home. Since everything is connected to the same account, I should be able to log in on my phone and see the same Projects and conversations I use on my PC.
That was all I wanted to do.
I was away from home with my Samsung phone and wanted to check something from one of my ChatGPT Projects.
But the ChatGPT app wasn’t logged in.
What followed was a much longer login process than I ever expected.
It started with a verification code that didn’t arrive
First, I was asked to verify my identity.
I tried using the email address registered with my account. But the verification code didn’t arrive when I expected it to.
If the code had arrived within a few seconds, or even within a reasonable amount of time, this story might have ended right there.
But it didn’t.
So naturally, I tried again.
When that didn’t work, I looked for another method.
Could I use SMS?
Was there another authentication option?
Would Chrome work instead of the app?
I ended up trying several different things.
This distinction matters:
I wasn’t repeatedly trying to authenticate for no reason. I tried other methods because the code didn’t arrive.
Then MFA entered the picture
Things became even more confusing when MFA — multi-factor authentication — appeared.
I was asked for a code from an authenticator.
But which authenticator?
Where was I supposed to find this code?
When I checked my settings later, authenticator-based MFA was enabled. But I don’t have a clear memory of setting it up or knowing which authenticator I was supposed to use.
So I tried SMS authentication instead.
No SMS arrived.
Even more frustrating, I couldn’t find an obvious “Resend code” option.
There was something like “Try another method,” but the alternative it offered was the authenticator I couldn’t use.
Can that really be called another method?
If none of the available methods are actually available to the user, it’s simply a dead end.
Where exactly did you send the code?
This was one of the most confusing parts of the whole experience.
When a screen says, “Enter the code,” what code does it mean?
- A code sent by email?
- A code sent by SMS?
- A code generated by an authenticator app?
These are completely different things.
Why not simply say:
“Enter the six-digit code we sent to ***@yahoo.com.”
Or:
“We sent an SMS to the phone number ending in ***1234.”
And if an authenticator is required:
“No email or SMS will be sent. Open the authenticator app you previously configured and enter the six-digit code shown there.”
That would make sense even to someone who isn’t an authentication or security expert.
After about 40 minutes, I still couldn’t log in
I spent roughly 40 minutes trying different ways to get into ChatGPT from my phone.
Eventually, I went looking for OpenAI’s Help system.
The first support interaction was also with AI.
It suggested the kinds of troubleshooting steps you might expect: try another browser, check the network, verify SMS settings, try another login method, and so on.
It wasn’t very different from the troubleshooting I had already been doing.
But eventually, I learned something important that I hadn’t seen during the login process:
After repeated login attempts, a temporary restriction may apply, and you may need to wait an hour or more before trying again.
I didn’t know that.
And I don’t remember seeing anything on the login screen telling me that this might be happening.
Then why not just tell me to wait an hour?
This may be the part that bothered me most.
If a temporary security restriction is active, why not display something like:
“Login has been temporarily restricted for security reasons. Please try again after 8:30 PM.”
If I saw that, I would stop.
I would understand that there was no point in continuing and simply wait.
Instead, the code didn’t arrive.
I didn’t know whether I should resend it.
The alternative method didn’t help.
And there was no clear indication that I should stop trying.
In that situation, a normal user is likely to think:
“Maybe I did something wrong. I’ll try again.”
When that fails, the user tries something else.
If those additional attempts then trigger or extend a security restriction, the experience becomes a strange loop.
Before telling users not to try too many times, the system should tell them:
“You can’t log in right now. Please wait X minutes before trying again.”
That one message could have prevented much of what happened to me.
About an hour later, I somehow got in
Eventually, about an hour after the trouble began, I was able to log in to ChatGPT on my Samsung phone.
But even that felt strange.
I can’t tell you exactly what worked.
Did a temporary restriction expire?
Did a delayed authentication process finally succeed?
Did a different verification method work?
I honestly don’t know.
Even after I got in, I didn’t get a strong sense of completion — something obvious like “Login successful,” or a clear profile image confirming that I was now signed in to the correct account.
Normally, if you struggle with a login once, you learn something:
Get Tetsuji Kondo’s stories in your inbox
Join Medium for free to get updates from this writer.
“Okay. Next time, this is what I need to do.”
I didn’t learn that this time.
I don’t know why the login failed, and I don’t really know why it eventually succeeded.
That means I can’t reliably repeat the process the next time it happens.
I’m not looking for advanced security features
Of course account security matters.
But I’m not trying to study authentication technology.
I just wanted to open my phone while I was away from home and check one of the ChatGPT Projects I had been using on my PC.
Should I really need to understand email verification, SMS, authenticator apps, MFA, passkeys, backup methods, and all the terminology surrounding them just to do that?
What I want is something much simpler.
Why can’t I approve the new device from my PC?
For example, I was already logged in to ChatGPT on my PC at home.
Why couldn’t a login attempt from my Samsung phone trigger a message on that trusted PC?
“Someone is trying to sign in from a Samsung device. Is this you?”
I click:
“Yes.”
The Samsung device is approved.
Or perhaps services could make better use of identity systems users already have on their devices.
My Android phone, for example, is already connected to my Google account, and I use Chrome.
Of course, a Google account and a ChatGPT account are separate things.
But from a user’s perspective, the important question isn’t the name of the authentication technology.
The important question is:
“Can the service safely and simply confirm that the person holding this phone is really the account owner?”
That is the goal.
The technical mechanism should serve that goal, rather than becoming something the user has to understand first.
What if your phone is the only device you have?
At home, I have access to a PC, a phone, and an iPad.
Away from home, the situation is different.
Sometimes all you have is one smartphone.
If you are trying to log in on that phone and the system tells you:
“Check another device.”
“Check your email.”
“Open your authenticator.”
what happens when those authentication routes aren’t available?
That was essentially the situation I found myself in.
Login systems shouldn’t be designed only around the ideal case where users have multiple devices nearby and every verification method works perfectly.
They should also consider an extremely ordinary situation:
You are away from home, and the only device you have is your phone.
Has security become so complicated that it prevents us from using the service?
I don’t think this problem is unique to ChatGPT.
Online services increasingly use passwords, email verification, SMS codes, authenticator apps, MFA, passkeys, security keys, and other layers of identity verification.
There are good reasons for these technologies.
Preventing unauthorized access matters.
But I think there is another question worth asking:
At some point, does security itself become the goal?
Security is supposed to allow legitimate users to use a service safely.
But what happens when the legitimate account owner can no longer get in?
I wasn’t trying to break into someone else’s ChatGPT account.
I was trying to open my own account on my own Samsung phone.
Yet I spent more than 40 minutes trying to log in, went through Help, and only then learned that waiting an hour might be necessary.
There is a difference between keeping attackers out and keeping legitimate users out.
A system designed to protect access shouldn’t end up preventing access.
Security should work even when users don’t understand it
I’m not arguing that MFA should disappear.
I’m not asking for weaker security.
The problem is that users need to understand what is happening.
Where was the code sent?
Was it successfully sent?
Is my account temporarily restricted?
How much longer do I need to wait?
Which authentication methods can I actually use right now?
Did the login succeed?
Simply making those things visible could have prevented much of the confusion I experienced.
AI services are becoming increasingly sophisticated.
I use ChatGPT regularly and organize many of my activities through its Projects.
That makes it even stranger when the entrance to such an advanced system is the part I can’t understand.
It doesn’t matter how capable the AI is if I can’t log in to use it.
And users shouldn’t have to study authentication systems before they can safely access their own accounts.
How do you handle this?
Maybe my experience isn’t unusual.
What do you do when you can’t log in to ChatGPT?
Do you already understand MFA, authenticator apps, passkeys, backup methods, and all the other authentication options?
Do you read the documentation and prepare everything in advance?
Or, like me, do you only start investigating these things when you suddenly can’t log in?
And there’s one question I’m especially interested in:
What would you do if you were away from home with only your smartphone and suddenly couldn’t log in to ChatGPT?
No PC.
No tablet.
The verification code isn’t arriving.
The alternative authentication method doesn’t work.
Shouldn’t there be a simple, secure way for the legitimate account owner to recover access in that situation?
Security doesn’t need to be weaker.
But security also shouldn’t require users to become authentication experts.
Do security and simplicity really have to be opposites?
I’d be interested to hear how other people manage authentication in everyday life — and what you would do in this situation.
