HackerOne 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
HackerOne is the bug bounty and vulnerability disclosure platform where researchers submit reports and companies run their programs. Two-factor authentication (2FA) isn't optional there. Since July 29, 2025, every HackerOne user has needed it unless they sign in through single sign-on (SSO/SAML), and accounts without it are prompted to finish setup before they can use the platform or submit reports (HackerOne).
The method HackerOne builds on is an authenticator app that makes time-based codes (TOTP). Once that's in place, you can also add security keys or Touch ID and Face ID as a second option (HackerOne). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the HackerOne steps come from HackerOne's own help center, linked below, which we read on October 21, 2026. We haven't tested them on a HackerOne account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
HackerOne's setup article for hackers, last updated in May 2026, gives these steps (HackerOne). If your account doesn't have 2FA yet, HackerOne may put you on a setup page right after you sign in instead.
- Click your profile in the top right corner and select User settings.
- Click Security, then Turn on.
- HackerOne shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, HackerOne lets you type its secret key by hand. In Novaz, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
- Click Next. HackerOne shows your backup codes. Save them now, because this screen won't come back.
- Click Next again. HackerOne asks for three things: the current code from Novaz, one of the backup codes you just saved, and your account password.
- Click Save.
Step 6 is unusual. HackerOne makes you prove you kept a backup code before it finishes, so copy the codes somewhere you can read them back before you click Next.
HackerOne's newer security keys article, from March 2026, calls the settings area Account security, so the menu name you see may differ from Security.
Backup codes are your only way back in
HackerOne says account recovery now runs on backup codes alone, which removes the need for a phone (HackerOne). That matters with Novaz, because its keys stay on your iPhone unless you turn on iCloud backup or export a backup file. If that phone is gone and you have no Novaz backup, the backup codes are what get you in. Keep them in a password manager or on paper, away from the phone.
To make a new set, go to your profile settings, then Security, and click Regenerate. Store the new codes, then enter your password, one of the new backup codes and a code from Novaz, and click Save. HackerOne notes that the backup code you type here isn't used up and still works later (HackerOne). If you aren't sure where your current codes are, HackerOne's FAQ suggests regenerating them now. More on storing them in 2FA backup codes.
HackerOne also mentions optional account recovery alerts with a phone number, available only to ID-verified researchers, researchers with at least one bounty, or accounts at least a year old with five valid, non-duplicate reports. Its pages don't explain what those alerts do, so don't count on them in place of backup codes.
When HackerOne asks for a code
Every time you log in. There's no option to remember a device (HackerOne). After your password, enter the 6-digit code from Novaz. If you've added a security key as well, the sign-in page offers Use authenticator app and Use security key, and you can pick either (HackerOne).
The FAQ says 2FA doesn't affect report submissions through the API.
If HackerOne rejects your code
HackerOne has a short article on this. Its explanation is that codes go wrong when your phone's time drifts more than 90 seconds from HackerOne's (HackerOne). The fix on iPhone is the one it gives: Settings > General > Date & Time, then turn on Set Automatically. Novaz warns you sooner, when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
HackerOne's help doesn't explain how to move 2FA to a new phone or replace the authenticator app you set up. The new phone won't have your HackerOne codes on its own, unless you restore your Novaz accounts there from iCloud backup or a backup file. Keep the old iPhone and your backup codes until you've confirmed you can still sign in, and ask HackerOne Support if you can't find a way to swap the app in your settings. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- At the code prompt, click Use a backup code, enter one of your codes, and click Verify (HackerOne).
- If you registered a security key, use Use security key instead.
- With neither, contact HackerOne Support. The help center points to support.hackerone.com for tickets.
Knowing your email and password isn't enough to reset 2FA, and HackerOne says that's by design (HackerOne). Its pages don't say what proof Support asks for or how long a recovery takes. More in Lost the phone with your authenticator app?
Turning 2FA off
You can't skip 2FA on HackerOne unless you sign in with SSO, and the help center doesn't describe turning it off. Security keys can be removed, but if you delete your last one and have no other method, HackerOne sends you straight back to the 2FA setup page (HackerOne).
