Skip to content
Novaz AuthenticatorGET

HitBTC 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. HitBTC gives you one backup code
  3. When HitBTC asks for a code
  4. If HitBTC rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Official HitBTC help

HitBTC is a cryptocurrency exchange, so your account holds funds that can be withdrawn and not brought back. Two-factor authentication (2FA) isn't required, but HitBTC urges you to turn it on as soon as you sign up (HitBTC). It supports two kinds: a code-generating app, which its help sometimes calls "Google 2FA", and a YubiKey that types Yubico OTP codes. You can have both on at the same time (HitBTC, HitBTC). This guide covers the app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the HitBTC steps come from HitBTC's own help center, linked below, which we read on October 21, 2026. Those articles were last updated between 2020 and 2022, and we haven't tested them on a HitBTC account, so a label may differ slightly. When we tried to open hitbtc.com from the US, it showed a page saying HitBTC doesn't serve that region, so we could only read the help center. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

HitBTC's newest setup article, from May 2022, gives this order (HitBTC). Note that the backup code comes first, before you see the QR code.

  1. On a computer, sign in at hitbtc.com and open the Security tab in your Settings (hitbtc.com/settings/security).
  2. Click Add 2FA App.
  3. HitBTC shows a backup code. Write it down or print it, exactly as shown, then click Confirm.
  4. HitBTC shows a QR code, plus a key you can type instead. Leave this window open.
  5. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. To type the key instead, tap +, then Enter key manually, and enter it as the Setup key. See What is a 2FA setup key?
  7. Back on HitBTC, click Next, type the code Novaz shows, and click Confirm.
  8. Check the email address on your HitBTC account. HitBTC sends a confirmation link, and you have to click it within 10 minutes or it expires.

HitBTC's help doesn't say how many digits its codes have or how often they change. Scanning the QR code is the safer choice, because it passes those settings to the app. A key typed by hand gets 6 digits every 30 seconds.

Because the link only lasts 10 minutes, check your spam folder right away if the email is slow (HitBTC).

HitBTC gives you one backup code

HitBTC gives you a single backup code, not a list. Its lost-device article says the code is case-sensitive, and that you type it into the same box where you'd normally put the 2FA code (HitBTC).

Keep it even if you back up Novaz with iCloud backup or a backup file: if the phone is lost and that backup is missing or was made before you added HitBTC, this code is how you get back in. Store the backup code on paper or in a password manager, away from that phone. If you also add a YubiKey, keep in mind that HitBTC gives no backup codes for it. See 2FA backup codes.

When HitBTC asks for a code

Once 2FA is on, HitBTC asks for a code every time you sign in and every time you try to withdraw (HitBTC). Its help doesn't describe a way to trust a device and skip the prompt.

If HitBTC rejects your code

HitBTC's own checklist (HitBTC):

  • Set your phone and your computer to the same correct time and time zone. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
  • Check the time zone in your HitBTC account, on the general Settings page (hitbtc.com/settings/general).
  • If you have more than one authenticator app, make sure you're reading the code from the one you used to set up HitBTC.
  • If the codes still fail, sign in with your backup code, turn 2FA off in Settings, and set it up again.
  • If none of that works, submit a request to HitBTC support.

More causes are in Authenticator code not working?

Changing phones

HitBTC's only article on moving 2FA is about exporting accounts from Google Authenticator (HitBTC). That's a Google Authenticator export, so it doesn't apply to Novaz. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and HitBTC's codes keep working. Otherwise, use the reset HitBTC describes for lost devices: sign in, turn off 2FA on the Security tab, then add it again with the new phone (HitBTC). Do this while the old phone still works, and remove HitBTC from it afterward by opening the account in Novaz and tapping Remove account. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

HitBTC's lost-device article covers both cases (HitBTC):

  • You have the backup code. Type it where the 2FA code goes and sign in. Then use the same backup code to turn off 2FA on the Security Settings page, and set it up again with your new phone.
  • You don't have it, or it doesn't work. Submit a 2FA removal request through HitBTC's support form. HitBTC will ask you to verify your identity and to give any information that shows you own the account. It describes this as a multi-stage process that takes some time, but doesn't give a timeframe or list the exact documents.

HitBTC has no phone support, so treat any caller claiming to be HitBTC as a scam (HitBTC). More in Lost the phone with your authenticator app?

Official HitBTC help

More guides: Crypto exchanges and wallets