Docker 2FA: how to set up an authenticator app

Your Docker account, the one your Docker ID belongs to, is what you use for Docker Hub, Docker Desktop and Docker Scout (Docker). Two-factor authentication (2FA) is optional, and Docker documents one method: a code from a time-based (TOTP) authenticator app, typed after your password (Docker). Two details catch people out. You get one recovery code, not a list. And once 2FA is on, docker login with a username and password stops working, so scripts and CI need a token.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Docker steps come from Docker's own documentation at docs.docker.com, linked below, which we read on October 20, 2026. We haven't tested them on a Docker account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

2FA belongs to your individual account. Organization and company settings have no 2FA option: organizations control sign-in with single sign-on instead (Docker). You need your Docker password and a verified email address (Docker). Docker's pages don't say how 2FA works if you signed up with Google or GitHub.

Turn on 2FA with an authenticator app

These steps are from Docker's page on managing 2FA (Docker):

1. Sign in to your Docker account at app.docker.com.
2. Select your avatar in the top-right corner, then Account settings.
3. Select 2FA.
4. Enter your password and select Confirm.
5. Docker shows your recovery code first. Select Copy, or use the menu next to it to Download or Print it, and keep it off your phone.
6. On the QR Code tab, scan the code: in Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
7. If scanning doesn't work, open the Text Code tab. In Novaz, tap +, then Enter key manually, and paste that code as the Setup key. See What is a 2FA setup key?
8. Type the six-digit code from Novaz in Authentication code and select Enable 2FA.

Docker doesn't say how often its codes change, so scanning is the safer route: the QR code carries the code settings, while a typed key always gets 30-second codes in Novaz.

The single recovery code

The recovery code works once. Using it signs you in, switches 2FA off and deletes the code, so set up 2FA again right after (Docker). If you lose your iPhone and have no Novaz backup (iCloud backup or a backup file), this code is your only way back in without Docker Support.

Lost the code but can still sign in? Go to Account settings > 2FA, enter your password, select Confirm, then Generate new code. Select the visibility icon to see it. The old code stops working (Docker).

Docker emails you when a recovery code is generated or used, but never sends the code itself (Docker). See 2FA backup codes.

Where Docker asks for the code

• Docker Home or Docker Hub in a browser: your password, then the authenticator code.
• docker login without a username: the same browser sign-in, unless that browser is already signed in.
• docker login -u, scripts and CI: a personal access token, typed where the CLI asks for a password. Your password isn't accepted there while 2FA is on (Docker).

If a pipeline signs in with your password, create a token before you turn on 2FA: Account settings > Personal access tokens > Generate new token. Copy it at once, because Docker shows it only once (Docker).

If Docker rejects your code

After several wrong codes, Docker shows Too many failed login attempts and blocks you for a short time (Docker), so wait rather than guessing. Docker's pages offer no other fixes. The usual cause is the phone's clock. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?

If docker login says Incorrect authentication credentials, the token or username is wrong, not the authenticator code (Docker).

Moving to a new phone

An account holds one authenticator at a time (Docker). Docker's method is to turn 2FA off, then on again from the new phone (Docker), so do it while the old phone still works. If you've turned on iCloud backup in Novaz or exported a backup file, you can restore your accounts on the new iPhone instead, and Docker's codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With your recovery code (Docker):

1. Sign in with your username and password.
2. On the Two-Factor Authentication page, select I've lost my authentication device.
3. Enter the recovery code and select Verify.

You're in, with 2FA off, so set it up again.

Without the code, use Docker's Contact Support form for 2FA lockouts, which comes filled in. Enter your account's email address and follow Support's instructions. Docker doesn't say what proof it asks for or how long it takes. More in Lost the phone with your authenticator app?

Turning 2FA off

In Account settings > 2FA, enter your password, select Confirm, then Disable 2FA. Docker emails you to confirm (Docker). Then, in Novaz, open the Docker account and tap Remove account.

Official Docker help

• Two-factor authentication for your individual Docker account
• Manage two-factor authentication for your Docker account
• Recover your Docker account and two-factor recovery code
• Create and manage personal access tokens
• Account FAQs
• Create a Docker account