Bitwarden 2FA: how to set up an authenticator app for two-step login
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Bitwarden account opens your password vault, so it guards every login stored there. Bitwarden calls two-factor authentication (2FA) two-step login. It's optional. Without it, Bitwarden emails you a code when you sign in on a new device; any two-step login method replaces that email check (Bitwarden).
An authenticator app, a FIDO2 security key and email are free. Duo and YubiKey OTP need Premium (Bitwarden). Bitwarden doesn't send codes by text message itself (Bitwarden). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Bitwarden steps come from Bitwarden's own help pages, linked below, which we read on October 20, 2026. We haven't tested them on a Bitwarden account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Keep this code out of your vault
Bitwarden makes codes two ways: inside the password manager, and in a separate Bitwarden Authenticator app. Of the two, its Field Guide says only the separate app can protect your Bitwarden account itself (Bitwarden). In that app, Bitwarden asks you to keep this code local so it never syncs into the vault it protects, which could lock you out (Bitwarden).
Novaz has no link to your vault, so that risk doesn't arise. Just don't also save the Bitwarden key in a vault item.
Turn on two-step login with an authenticator app
You set this up in the Bitwarden web app. Bitwarden's help describes these steps (Bitwarden):
- Log in to the web app: vault.bitwarden.com, or vault.bitwarden.eu if your account is on Bitwarden's EU server.
- Go to Settings > Security > Two-step login.
- On the Authenticator App line, select Manage and enter your master password.
- Bitwarden shows a QR code, plus a key you can type instead. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- To type the key instead, tap +, then Enter key manually. Put Bitwarden in Service, your email address in Account, and the key in Setup key. See What is a 2FA setup key?
- Type the six-digit code from Novaz into the dialog and select Enable. A green Enabled message appears.
- Select Close. Authenticator App should now show a green check mark.
Bitwarden's codes have six digits and usually change every 30 seconds, so a typed key works in Novaz.
Bitwarden suggests keeping that tab open while you test the code by signing in elsewhere. Then log out of your other Bitwarden apps so each one asks for it.
Save the recovery code
Bitwarden gives you one recovery code, not a list. To see it, go to Settings > Security > Two-step login, select View recovery code, enter your master password and select Continue (Bitwarden).
Store it outside your vault: Bitwarden can't look it up for you (Bitwarden) and suggests a printed copy (Bitwarden). It changes each time you use it. If the iPhone is gone and you have no Novaz backup, this code is your way back in. See 2FA backup codes.
When Bitwarden asks for the code
- Every log-in, in any Bitwarden app, after your master password. Unlocking a vault you're already logged in to doesn't need it.
- Not for 30 days on a device where you check Remember Me (Bitwarden).
- Only if nothing ranks higher. A FIDO2 key, YubiKey or Duo comes first; select Use another two-step login method to switch (Bitwarden).
If Bitwarden rejects your code
Bitwarden's sign-in pages don't cover this. Its built-in authenticator page blames the device clock and, on iPhone, says to turn Set Automatically off and back on under Settings > General > Date & Time (Bitwarden). Novaz warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Bitwarden says you can add a device by repeating the setup steps and scanning the QR code with it (Bitwarden). Do it while the old iPhone still works, and test a code from the new one before wiping the old. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Bitwarden says your options depend on what you set up beforehand (Bitwarden):
- Another method. On the login screen, select Use another two-step login method.
- Your recovery code. Open the recovery page for your server: vault.bitwarden.com/#/recover-2fa/ for the US, vault.bitwarden.eu/#/recover-2fa/ for the EU, or your own domain if you self-host. Enter your email, master password and recovery code, then Submit. This logs you in and turns off every two-step login method; set one up again and save the new code (Bitwarden).
- Your organization. If you're enrolled in account recovery, an admin can reset your two-step login.
- A trusted emergency contact with takeover access. Once they start emergency access and the wait time passes, your two-step login methods are turned off.
- A Bitwarden app that's still logged in. In the web app, view and use your recovery code. In another app, export your vault and import it into a new account.
If none of these work, "there is no way for Bitwarden to recover the account or its data" (Bitwarden). You'd delete it and start over; contact Bitwarden to move a Premium subscription to the new account. More in Lost the phone with your authenticator app?
