ANY.RUN 2FA: how to set up an authenticator app

ANY.RUN is an interactive sandbox for analyzing malware, phishing links and suspicious files, with threat intelligence tools on the side. Your account holds your analysis history, and on paid plans that includes private tasks your team may not want anyone else to see. ANY.RUN's second factor is a time-based code from an authenticator app, and the company calls it "Highly recommended for anyone dealing with private malware analyses" (ANY.RUN). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the ANY.RUN steps come from ANY.RUN's own website and official blog, linked below, which we read on October 21, 2026. ANY.RUN doesn't publish a step-by-step help article for 2FA, so these pages describe where the setting is rather than every screen. We haven't tested them on an ANY.RUN account, so a label may differ. The Novaz steps are checked against the app, version 1.0.5.

Is 2FA required?

For a personal account it's optional. On a team, it may not be up to you:

• ANY.RUN says teams can make 2FA a mandatory security measure, for example to meet compliance rules (ANY.RUN, ANY.RUN).
• The team master manages security for all members, and the team's 2FA setting is on for members by default (ANY.RUN).
• On the Enterprise plan, 2FA can be switched on or off for each team member (ANY.RUN).

If your company signs you in with single sign-on (SSO), your identity provider, such as Okta or Microsoft Entra ID, handles that sign-in (ANY.RUN). ANY.RUN's pages don't say how its own 2FA works alongside SSO, so ask whoever runs your team's ANY.RUN setup.

Turn on 2FA with an authenticator app

ANY.RUN's blog describes where the setting is (ANY.RUN):

1. Sign in to ANY.RUN at app.any.run and open your Profile. Its menu sits at the top of the profile page.
2. Go to Security. This is where you change your password and turn on two-factor authentication.
3. Start the two-factor setup and follow the screens.

That blog post dates from 2022, so the screens may look different now. ANY.RUN's pages don't show the setup screens, and they don't say whether a text key is offered next to the QR code or how many digits the codes have.

Then add ANY.RUN to Novaz:

1. In Novaz, tap +, then Scan QR code, and point the camera at the code on your computer screen. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
2. If ANY.RUN only gives you a key, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
3. Type the current code from Novaz back into ANY.RUN to confirm.

Because ANY.RUN doesn't publish its code settings, scanning is the better choice. A QR code tells Novaz the digits and interval to use, while a typed key always gets 6 digits every 30 seconds.

Backup codes

ANY.RUN's public pages don't mention backup or recovery codes. If the setup screen offers any, save them somewhere other than your phone. Without a Novaz backup, the keys exist only on that iPhone, so those codes would be your way in if the phone is gone. More in 2FA backup codes.

If ANY.RUN rejects your code

ANY.RUN has no published advice on this. The most common cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when your clock is 15 seconds or more off. Other causes are covered in Authenticator code not working?

Changing phones

ANY.RUN doesn't describe how to move the authenticator to a new phone. If you use Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and the codes keep working. Without one, plan for a fresh setup: keep the old iPhone working until ANY.RUN accepts codes from the new one. If Security doesn't let you redo the setup yourself, contact technical support (below) before you give up the old phone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

ANY.RUN doesn't publish a recovery process, what proof it asks for, or how long it takes. Its contact page lists techsupport@any.run for technical support, and the same page has a support form (ANY.RUN). Write from the email address on your account.

If you're on a team, also tell your team owner or admin. They control the team's 2FA setting (ANY.RUN), although ANY.RUN doesn't say whether they can reset one member's authenticator. More in Lost the phone with your authenticator app?

Official ANY.RUN help

• Compliance
• Teamwork Update, Redesigned Profile, and a New Enterprise Suite Plan
• How ANY.RUN Protects Privacy of Enterprise Clients
• Manage Large Security Teams with ANY.RUN for Enterprises
• Contact us