Fastmail 2FA: how to set up an authenticator app

Fastmail is a paid email service, and for many people the account also holds their calendar, contacts and custom-domain mail. Fastmail calls its 2FA "two-step verification." It's optional, and you can use an authenticator app, a security key, a standalone OTP device, or a text message as a backup (Fastmail).

The one thing that catches people out: you can't add an authenticator app until your account has a recovery phone number. This guide covers that step first. We use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Fastmail steps come from Fastmail's own help pages, linked below, which we read on October 21, 2026. We read the pages as plain HTML and took the last-edited dates from Fastmail's public help center feed. We haven't tested them on a Fastmail account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Step 1: add a recovery phone

Fastmail requires a recovery phone before your first verification device, so a lost phone doesn't lock you out (Fastmail):

1. Open Settings, then Privacy & Security.
2. In the Account recovery section, click Add recovery options.
3. Click Add recovery phone. If a Verify it's you box appears, enter your password and click Continue.
4. Enter your number and click Send verification code.
5. Type the code from the text message and click Verify, then Done.

Fastmail's page on passwords calls the same button Manage recovery options and also lets you add a recovery email address (Fastmail), so the label you see may be either one.

Step 2: add the authenticator app

1. Back on Privacy & Security, find Password & Two-step verification and click Manage two-step verification.
2. Click Add verification device. Enter your password again if Fastmail asks.
3. Choose the authenticator app option. Fastmail's help calls it Authenticator app (TOTP) (Fastmail).
4. Fastmail shows a QR code and a key. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you'd rather type the key, tap +, then Enter key manually in Novaz. Fill in Service (for example, Fastmail), Account if you like, and paste the key into Setup key. Fastmail's help doesn't give the key a name. See What is a 2FA setup key?
6. Type the 6-digit code from Novaz into Fastmail.
7. Give the device a name, such as "Novaz on iPhone." Fastmail lists your devices by name so you can remove one later (Fastmail).

You can add more than one verification device. If you rely on Novaz, adding a second method, such as a security key, gives you a way in that doesn't depend on one iPhone.

Write down your recovery code

Fastmail doesn't give a list of backup codes. Instead, the Account recovery screen shows a single recovery code made for your account. You can use it with the recovery tool if you forget your password or lose your verification device, and Fastmail strongly recommends writing it down or printing it (Fastmail).

Your recovery phone and that recovery code get you back in if you lose the phone and have no Novaz backup, so keep the code somewhere other than your phone. More in 2FA backup codes.

Signing in, trusted computers and mail apps

At the login page you enter your username and password, then the current code from Novaz. If you have more than one method, Verify another way switches between them. You can mark a computer as trusted so it stops asking, and revoke that later on Privacy & Security (Fastmail).

Two-step verification works in the web interface and the Fastmail app. Other mail and calendar apps, such as Apple Mail or Outlook, need an app password instead of your normal password (Fastmail).

If Fastmail rejects your code

Fastmail's help doesn't cover rejected codes. The usual cause is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If a mail app says your password is wrong, that's an app password problem, not a 2FA one. More causes are in Authenticator code not working?

Changing phones

Fastmail's help doesn't describe moving an authenticator to a new phone, or removing a device step by step. Since you can have several verification devices, a safe order is to add the new iPhone as another device while the old one still works, then remove the old entry. If you restore a Novaz iCloud backup or backup file on the new iPhone, your Fastmail codes keep working as they are. Without one, you'll scan a new QR code on the new phone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Try these in order:

• Text message. If your recovery phone is still on the account, choose Verify another way at login and get a code by SMS. Fastmail notes that a phone alone isn't enough: you still need your password (Fastmail).
• Another device. A security key or second authenticator you added earlier.
• The account recovery tool. Fastmail points anyone who has lost a two-step device to its recovery tool (Fastmail). Your recovery code helps here.

Recovery with two-step verification on still needs two independent factors. If it succeeds, Fastmail waits 24 hours before the last step and emails you, so you can stop it if it wasn't you. Resets started from a device, browser or location the account doesn't recognize also wait 24 hours, so use your usual computer if you can (Fastmail).

You can remove the recovery phone after setup, but Fastmail warns that without it, your devices or your recovery code, you "may be permanently locked out" (Fastmail). See also Lost the phone with your authenticator app?

Official Fastmail help

• Using two-step verification (2FA)
• I can't log in!
• Passwords
• App passwords
• Using 1Password on Fastmail web interface