HEY 2FA: how to set up an authenticator app

HEY is the paid email service from 37signals, with personal @hey.com addresses and HEY for Domains for your own domain. One thing sets its two-factor authentication (2FA) apart: it's a one-way switch. HEY's help says plainly that once you set up 2FA, it stays on for your account, and there's no way to turn it off (HEY). Read the recovery section before you start.

HEY's 2FA uses six-digit time-based codes (TOTP) from an authenticator app on your phone, and you can add a hardware security key as an extra (HEY). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the HEY steps come from HEY's own help center and security page, linked below, which we read on October 21, 2026. We haven't tested them on a HEY account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is 2FA required?

HEY's pages don't agree on this. Its security page and its FAQ say 2FA is required for all paying customers (HEY, HEY). An older help article, last updated in January 2024, says it's required for HEY for Domains customers and highly encouraged for personal accounts (HEY).

Turn on 2FA with an authenticator app

HEY suggests doing this with two devices: your computer for HEY and your phone for the code app (HEY).

1. On your computer, go to app.hey.com/accounts, or click your avatar (top right) in the Imbox.
2. Click Login & Security, then Two-Factor Authentication.
3. Click OK, I've got a 2FA app on my phone.
4. HEY shows a QR code on the Step 2: Scan + Enter the Code screen. In Novaz, tap +, then Scan QR code, and point the camera at it.
5. Type the six-digit code from Novaz and click Verify and continue.
6. Save your recovery codes with Copy, Print or Save, then click OK, I've saved my codes.

HEY's help only describes scanning the QR code. It doesn't mention a text key you could type instead, so plan to scan. If you only have your iPhone, take a screenshot of the code, then tap + and Choose a photo in Novaz. See scanning a QR code on the same iPhone. If HEY's screen does offer a key, use Enter key manually and see What is a 2FA setup key?

Your recovery codes

HEY's recovery codes look like XXXXX-XXXXX, and each one works once (HEY). Since 2FA can't be switched off, they matter more than usual. Keep them even if you back up Novaz with iCloud backup or a backup file: they get you in when the phone is gone and there's no up-to-date Novaz backup. Keep them away from that phone: on paper or in a password manager.

You can see them again later: Login & Security > Recovery Codes, then your password and Continue. To make a fresh set, scroll to the bottom of that page and click Generate new recovery codes. The old ones stop working. You can do both in the HEY iOS and Android apps too (HEY). More in 2FA backup codes.

Signing in

You sign in at app.hey.com/sign_in with your HEY address and password. If HEY asks for a 2FA code, you type the code from your app (HEY). HEY's help doesn't say how often it asks, or whether it remembers devices.

If you've linked accounts, for example a work address under your @hey.com one, you sign in with the password and 2FA of the account you linked from. The linked account's own 2FA stops working (HEY).

If HEY rejects your code

If a recovery code fails, HEY says to try another one from your set. For app codes, check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

HEY has no article for a new phone, but its sign-in help lets you replace your 2FA setup from a device where you're still signed in (HEY):

1. Click your avatar, then Login & Security > Two-Factor Authentication.
2. Click Yes, replace my 2FA setup and enter your password.
3. Scan the new QR code with the new phone, and save the new recovery codes.

The old setup stops working at once. If you use Novaz's iCloud backup or a backup file, you can skip this and restore your accounts on the new iPhone instead; the HEY codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

HEY's sign-in help gives three routes, in this order (HEY):

• A recovery code. Sign in with your password, click Use a recovery code to access your account, enter a code and click Continue. Then set up 2FA again under Login & Security > Two-Factor Authentication.
• Another signed-in device. If you're still signed in somewhere, use Yes, replace my 2FA setup as in the steps above.
• Support. If you're still locked out, email support@hey.com.

HEY doesn't say what proof support asks for or how long it takes. Its security page warns that losing your second factor means a "lengthy, annoying reset process" (HEY). A forgotten password is separate: the reset goes to the backup email address on your account (HEY). More in Lost the phone with your authenticator app?

Official HEY help

• Two-Factor Authentication (2FA) and Login Security
• Logging In
• How's HEY's security?
• What if I forget my password?
• Link up multiple accounts
• Serious security
• Frequently asked questions about HEY