Leave the code empty only if your account has no authenticator.
Five failed attempts lock the account for 15 minutes.