Mozilla's Bugzilla (BMO) 2FA: how to set up an authenticator app

bugzilla.mozilla.org, or BMO, is where bugs in Firefox and other Mozilla projects get filed and fixed. Its two-factor authentication (2FA) is set in BMO's own preferences and works with your BMO password. Anyone can use a TOTP authenticator app. Mozilla employees, and members of some Mozilla groups, use Duo Security instead (BMO).

2FA is optional for most people, but BMO can set an enrollment deadline on an account. If you see one, turn 2FA on before that date: after it, BMO keeps you on the 2FA preferences page until you do (BMO). The documentation doesn't say which accounts get one. This guide uses Authenticator App - Novaz on iPhone for TOTP, but any authenticator app works the same way.

How we checked this guide: the BMO steps come from BMO's own documentation, linked from the bugzilla.mozilla.org home page, and its older Mozilla Wiki guide, both linked below, which we read on October 21, 2026. We haven't tested them on a BMO account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: you need a BMO password

BMO can only turn on 2FA for an account that has a password. If you sign in through another provider and never set a BMO password, open the 2FA preferences page, choose Reset Password, and follow the link BMO emails you (BMO).

Turn on 2FA with an authenticator app

These are the steps in BMO's current documentation (BMO):

1. Sign in and open BMO's Two-Factor Authentication preferences. You can also go to Preferences and pick the Two-Factor Authentication tab.
2. Click Time-based One-Time Password (TOTP). If your account is in a group that requires Duo, this option doesn't appear.
3. Enter your current BMO password.
4. BMO shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is on the same iPhone, take a screenshot and tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, click Show as text above the QR code to see the secret. In Novaz, tap +, then Enter key manually, and type the secret as the Setup key. BMO's codes are six digits every 30 seconds, which is what manual entry makes. See What is a 2FA setup key?
6. Type the six-digit code from Novaz and click Submit Changes.

The page then shows TOTP as enabled. Delete any screenshot of the QR code: BMO warns that it can make codes for your account, and it won't show the secret again.

Turning 2FA on or off signs out your other BMO sessions. It also switches on Require API key authentication for API requests, so a script that logs in to the BMO API with your password will stop working until you give it an API key (BMO).

Print your recovery codes

Make these right away, before you sign out:

1. On the Two-Factor Authentication tab, click Generate Printable Recovery Codes.
2. Enter your password and a current code from Novaz.
3. Click Generate Printable Recovery Codes again.

You get ten single-use codes of nine digits each. A new set cancels the old one. Unlike many services, BMO wants these on paper: print them and keep them offline, not with your password and not on the phone that makes your codes (BMO). The older wiki guide describes the codes as 10 digits (Mozilla Wiki); the newer documentation says nine.

If that phone is gone and you have no Novaz backup (iCloud backup or a backup file), these printed codes are your only way back in. More in 2FA backup codes.

When BMO asks for a code

You enter a code after your email address and password each time you sign in, and again before sensitive changes such as a new email address or password, a new API key, or turning off the API key requirement. An unused recovery code works in the same field (BMO).

If BMO rejects your code

BMO's troubleshooting list (BMO):

• Use the code from the BMO entry, not another account's.
• Let the phone set the date and time automatically. On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
• If the code is about to change, wait for the next one.

If codes still fail while you're signed in, use a recovery code to turn TOTP off and set it up again. If you're signed out, that takes two recovery codes: one to sign in, one to turn it off. More causes are in Authenticator code not working?

Changing phones

BMO suggests turning TOTP off while the old phone still works, setting it up again on the new one, and making new recovery codes (BMO). That's the route with Novaz if you have no backup. With iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With your recovery codes, sign in using one, open the Two-Factor Authentication tab, click Disable Two-factor Authentication, enter your password and a second unused code, and click Submit Changes. Then set up TOTP again and print a new set of codes (BMO).

Without them, email the BMO administrators at bugzilla-admin@mozilla.org. You'll need to show enough to prove the account is yours, and BMO says recovery isn't guaranteed (BMO). It doesn't say what proof it accepts or how long this takes. The older wiki guide sends Mozilla employees to Mozilla Service Desk instead (Mozilla Wiki). See also Lost the phone with your authenticator app?

Turning 2FA off

Use Disable Two-factor Authentication on the same tab, with your password and a current code or an unused recovery code. To switch to Duo, turn TOTP off first, then set up Duo right away (BMO).

Official BMO help

• Two-Factor Authentication (BMO documentation, User Guide 2.9)
• BMO/UserGuide/Two-Factor Authentication (Mozilla Wiki, older guide)
• Two-Factor Authentication preferences on bugzilla.mozilla.org (sign-in required)