Hotjar 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Hotjar is the heatmap, session recording and survey tool that many teams add to their websites, so a Hotjar login can open up recordings of real visitors. Its two-factor authentication (2FA) has a single method: a code from an authenticator app. Hotjar doesn't send codes by text message, and it gives you recovery codes in case the app is gone (Hotjar). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app that makes time-based codes works the same way.
How we checked this guide: the Hotjar steps come from Hotjar's own help center, linked below, which we read on October 21, 2026. The help center's web pages blocked automated requests, so we read the same articles through the help center's public article feed on help.hotjar.com. We haven't tested them on a Hotjar account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- SAML SSO users can't use it. If you sign in to Hotjar through your company's SAML single sign-on, Hotjar's 2FA isn't available to you (Hotjar). Your identity provider handles that part.
- Your organization may require it. Accounts with at least one Site on the Scale plan can enforce 2FA for everyone at the Organization level (Hotjar).
- Check which login you have. Hotjar and Contentsquare are moving onto a shared platform, and for now each has its own login page. Hotjar accounts sign in at insights.hotjar.com/login (Hotjar). This guide covers that Hotjar login.
Turn on 2FA with an authenticator app
These steps follow Hotjar's 2FA article (Hotjar):
- Sign in to Hotjar and open your My Details page (insights.hotjar.com/profile/details).
- Under Account Security, click Enable Two-Factor Authentication.
- If Hotjar asks, click Verify email address and type the code it emails you. If it doesn't ask, go straight to the QR code.
- Hotjar shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If Hotjar is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Click Next in Hotjar.
- Type the current six-digit code from Novaz and click Next.
- Download or Print your recovery codes and put them somewhere safe.
Hotjar's article doesn't mention a text key you can type instead of scanning, so plan to scan the QR code. If a key does appear under the code, Novaz can take it through + > Enter key manually, typed into Setup key. See What is a 2FA setup key?
Hotjar's account setup article describes the same button under a heading called Security rather than Account Security (Hotjar), so look for either one.
One authenticator per person
Hotjar allows only one authenticator app at a time for each team member (Hotjar). You can't register a second phone as a spare. That makes the recovery codes important, even if you back up Novaz with iCloud backup or a backup file: they get you in if the phone is lost and that backup is missing or out of date. Hotjar suggests printing them and also storing them somewhere secure, such as a password manager. See 2FA backup codes.
Signing in with a code
Once 2FA is on, you can't sign in without an authenticator code or a recovery code (Hotjar). Hotjar's pages don't say whether it remembers trusted devices, or whether the code is also asked for when you use Sign In With Google.
If Hotjar rejects your code
Hotjar's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Make sure you're typing the code from the Hotjar entry, too. More causes are in Authenticator code not working?
Changing phones
Hotjar's pages don't describe moving 2FA to a new phone. The controls they do document are on My Details: turn 2FA off, then turn it on again and scan the new QR code with the new phone. Do this while the old phone still works. You can skip this if you restore your Novaz accounts on the new iPhone from iCloud backup or a backup file; without one, the new iPhone needs a fresh setup. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use a recovery code. On the Hotjar login page, enter your email and password. When Hotjar asks for the authentication code, click Enter a recovery code, type one of your 10-character codes and click Verify (Hotjar). Once you're in, turn 2FA off and set it up again with your new phone. The setup ends with a new set of recovery codes to save.
If you have neither the app nor the recovery codes, Hotjar says to contact its Support team through the Contact us button on the 2FA article. It doesn't say what proof it asks for or how long it takes. More in Lost the phone with your authenticator app?
Turning 2FA off
On My Details, under Account Security, click Disable Two-Factor Authentication, then confirm with Disable two-factor authentication (Hotjar). Then remove the Hotjar entry in Novaz: open it and tap Remove account.
