1Password 2FA: protect your 1Password account with an authenticator app

1Password already protects your account with two secrets: your account password and your Secret Key. Two-factor authentication adds a third thing someone would need, but only at one moment: signing in to your account on a new device. Devices that are already signed in keep working without a code (1Password). This guide sets it up with an authenticator app on iPhone. We use Authenticator App - Novaz in the steps, but any authenticator app works the same way.

How we checked this guide: the 1Password steps come from 1Password's own support pages, linked below, which we read on October 12, 2026. We haven't tested them on a 1Password account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Use a different app for this code

1Password can store one-time codes for your other accounts. For the code that protects 1Password itself, 1Password tells you to use a different authenticator app: keeping it inside 1Password would be "like putting the key to a safe inside the safe itself" (1Password). If you lose access to 1Password, you'd lose the code you need to get back in.

Turn on 2FA with an authenticator app

1Password's support page describes these steps (1Password):

1. Sign in to your account on 1Password.com, on a computer if you can.
2. Select your name at the top right, then Manage Account.
3. Select More Actions > Manage Two-Factor Authentication.
4. Select Set Up App. 1Password shows a QR code with a 16-character secret next to it.
5. Write down the 16-character secret and keep it somewhere safe, away from your phone. 1Password suggests keeping it with your passport and your Emergency Kit. It's your backup if you lose your authenticator app.
6. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
7. On 1Password.com, select Next, type the six-digit code from Novaz, and select Confirm.

1Password doesn't give separate backup codes for two-factor authentication. The 16-character secret is the backup.

Why the 16-character secret matters with Novaz

Novaz keeps its keys on your iPhone and only copies them elsewhere if you turn on iCloud backup or export a backup file. If that iPhone is lost and you have neither, the 16-character secret lets you add your 1Password account to an authenticator on a new phone: in Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key? Treat the secret like a password: anyone who has it can make your codes.

When 1Password asks for a code

After you turn it on, you need a code to sign in on a new device, and to sign in again on your existing devices. After that, 1Password asks again only in a few cases, such as when you sign out on a device, change your email or account password, or regenerate your Secret Key (1Password).

Under Manage Account, the gear button next to each linked app or browser has Require 2FA on Next Sign-in, which makes that device ask for a code again.

Add a security key too

You can also add a FIDO U2F security key, such as a YubiKey or Titan, with Add a Security Key on the same page. If you have both, you can choose your authenticator app instead when the key isn't with you (1Password).

If 1Password rejects your code

1Password's only listed fix is the date and time on the device that makes the codes (1Password). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when your iPhone's clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

Without your authenticator, you can't sign in to 1Password on a new device until two-factor authentication is turned off (1Password). In order:

• You wrote down the 16-character secret: add it to an authenticator on your new phone (see above) and carry on.
• 1Password is still signed in somewhere, such as your Mac or a browser: turn two-factor authentication off there (see below), then set it up again with your new phone.
• You're in a family or team account: your family organizer or a team administrator can recover your account. This resets your two-factor authentication. You get a new Secret Key and choose a new account password (1Password).
• A 1Password recovery code won't help here. It's a separate feature for individual and family accounts that gets you in when you've lost your password or Secret Key. If two-factor authentication was on, it stays on (1Password).

1Password's pages don't describe what someone on an individual account can do with no secret, no signed-in device and no organizer. Contact 1Password Support in that case.

More in Lost the phone with your authenticator app?

Turning 2FA off

• On 1Password.com, in a browser where you're already signed in: Manage Account > More Actions > Manage Two-Factor Authentication > Turn Off Two-Factor Authentication, then enter your account password.
• In the 1Password app, on a device that's already signed in: open Manage Accounts, choose the account, then the … menu > Turn off two-factor authentication > Turn Off.

On 1Password Business, administrators can require two-factor authentication for everyone under Policies (1Password). If your company uses Duo, you won't see the option to turn it on yourself, because Duo already handles it (1Password).

Official 1Password help

• Turn on two-factor authentication for your 1Password account
• Use your security key as a second factor for your 1Password account
• Recover accounts for family or team members
• Generate and use recovery codes