Hetzner 2FA: how to set up an authenticator app

Hetzner Accounts, at accounts.hetzner.com, is the sign-in for your Hetzner customer account, with your products, projects and invoices (Hetzner). Two-factor authentication (2FA) is optional, but Hetzner recommends it, partly because promo codes on the account are worth money (Hetzner). Its account tour video names the options: "Via Yubikey or authentication app on your smartphone or tablet" (Hetzner).

Plan for the recovery key before you start. Hetzner gives you one when you turn 2FA on, and if you lose it, a replacement only comes by regular mail (Hetzner). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Hetzner steps come from Hetzner's own documentation, linked below, including the screenshots in its 2FA article and the tour video on its getting-started page, which we read on October 20, 2026. The 2FA article dates from 2020, so a label may differ slightly. We read the account recovery form in an archived copy from October 9, 2026, because the live page blocks automated access. We haven't tested the steps on a Hetzner account. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

From Hetzner's 2FA article and its newer tour video (Hetzner, Hetzner):

1. Sign in to Hetzner Accounts.
2. Under Settings, open Two-factor authentication and click Enable 2FA. (The 2020 article spells it Enable 2-FA.) Hetzner signs you out of all sessions when 2FA goes on.
3. Enter your account password and confirm that you understand a lost recovery key is replaced only by post.
4. Hetzner shows your customer number and recovery key. Write both down, away from your phone, then click SET UP AUTHENTICATION.
5. Pick the smartphone option (Hetzner's screenshot lists it as Mobile device), then follow the instructions on screen.
6. If Hetzner shows a QR code, open Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
7. If you get a text key, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
8. If Hetzner asks for a code to confirm, type the current one from Novaz.

Hetzner's pages don't say whether you get a QR code, a text key or both, or how long the codes are. Scan the QR code if you can: it passes the code settings to the app, while a typed key always gives 6-digit codes every 30 seconds. Afterwards, the page lists your methods and shows the status as ACTIVE.

The recovery key is your backup

Hetzner's documentation doesn't mention backup codes; the recovery key does that job. If a 2FA sign-in fails, a red DISABLE 2FA option appears under VERIFY. Your recovery key there signs you in and turns 2FA off (Hetzner), so you'd set it up again later.

Without a Novaz backup (iCloud backup or a backup file), the recovery key is what saves you if that phone is gone. Keep it on paper or in a password manager. CHANGE KEY in the RECOVERY KEY box replaces it and retires the old one. See 2FA backup codes.

What changes when you sign in

Without 2FA, Hetzner emails a 6-digit code when you sign in from a new device or an unusual location. With 2FA on, those emails stop and your 2FA method replaces them (Hetzner). Support OTP, the text-message code for phone support, isn't switched on automatically for accounts with 2FA (Hetzner).

If Hetzner rejects your code

Hetzner's documentation doesn't cover rejected codes. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. Save DISABLE 2FA for last, since it turns 2FA off for the whole account. More causes in Authenticator code not working?

Changing phones

Several methods can be active at once (Hetzner), so add the new phone first: click Add new authentication method, set up the new iPhone, then delete the old entry with the x next to it. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Another method. If you added a YubiKey or a second phone, sign in with it.
2. Your recovery key. Use DISABLE 2FA on the sign-in screen, as above.
3. No recovery key. Hetzner issues a new one after a manual review (Hetzner). On the Recover access to your account form, choose New recovery key (2FA) and enter your Client number (it starts with K and is on the top right of your latest invoice), an Email where Hetzner can reach you, ideally the one on your account, and a short explanation. Hetzner may ask for documents (Hetzner, archived copy). The new key comes by post, and Hetzner doesn't say how long that takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

The Two-factor authentication page has a DISABLE button for the whole account, plus DISABLE and ENABLE buttons for each method (Hetzner). Once it's off at Hetzner, open the account in Novaz and tap Remove account.

Official Hetzner help

• Two-factor authentication
• Hetzner Account Getting Started (includes the account tour video)
• Login-OTP
• Support OTP
• Promo codes on your Hetzner account
• Recover access to your account (form; we read an archived copy)