Hurricane Electric 2FA: how to set up an authenticator app

One Hurricane Electric (HE) login covers its free IPv6 Tunnel Broker at tunnelbroker.net, the IPv6 Certification program, Free DNS at dns.he.net, and math.he.net (Hurricane Electric). Your tunnels and any DNS zones you host with HE are tied to that account (Hurricane Electric). Two-factor authentication (2FA) is optional, and the one method HE describes is an authenticator app with time-based codes, such as Google Authenticator or Authy (Hurricane Electric).

HE leaves little room for mistakes. If you lose both the app and your backup codes, its FAQ says "there is no way back into the account without it" (Hurricane Electric). Saving the backup codes is part of the setup here.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Hurricane Electric steps come from HE's own pages, linked below: its IPv6 FAQ, its registration page, and posts by HE staff (forum administrators) on its official Tunnel Broker forums. We read them on October 20, 2026. The staff posts date from 2015 to 2019 and HE has no step-by-step setup guide, so the screens may look different now. We haven't tested them on a Hurricane Electric account. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

The two-factor settings are on your account information page. The FAQ says your backup codes are there, and a staff announcement says they appear under the two-factor section (Hurricane Electric, Hurricane Electric). HE doesn't name the buttons on the setup screen.

1. Sign in at tunnelbroker.net or ipv6.he.net/certification with your HE account name and password.
2. Open your account information page, the same page that has the option to remove your account.
3. Find the two-factor section and turn it on.
4. If HE shows a QR code, tap + in Novaz, then Scan QR code. If the code is on the same iPhone, take a screenshot and tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If HE shows a text key instead, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
6. If HE asks for a code to confirm, type the current code from Novaz.

HE doesn't say how many digits its codes have or how often they change, so scan the QR code if offered: it carries the code settings, while a typed key always gets 6 digits every 30 seconds.

HE's pages don't say whether turning it on at one HE site protects the others, so after setup, check that each HE site you use asks for a code.

Save your backup codes before you leave the page

Once two-factor is on, a Backup codes section appears under it. Show codes lists the ones you haven't used, and Reset codes makes a completely new set of ten. Each code works once, anywhere HE asks for an authentication code (Hurricane Electric).

In that post, HE staff also pointed to its own iOS app, HE.NET Network Tools, which syncs time-based keys through iCloud Keychain if you've turned that on (Hurricane Electric). Novaz can keep a copy too, with iCloud backup (PRO) or a backup file, but keep your backup codes anyway: they get you in if the phone is lost and that backup is missing or old. Write them down or keep them in a password manager. More in 2FA backup codes.

If HE rejects your code

HE's pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. A backup code also works in place of an app code. Other causes are in Authenticator code not working?

Changing phones or turning 2FA off

HE doesn't describe moving the authenticator to a new phone or turning two-factor off. With Novaz, you can restore your accounts on the new iPhone from iCloud backup or a backup file. Without one, before you give up the old phone, sign in and look in the two-factor section for a way to set it up again, and make sure you still have unused backup codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with your password and a backup code. Then set up the authenticator again if the page lets you, and use Reset codes if you're running low.

A password reset won't help. HE staff explained that you can reset the password without the second factor, but you still can't get into the account without it (Hurricane Electric).

With neither the app nor a backup code, HE's FAQ says you can't get back in. In 2019, an HE administrator told a user who had lost both to open a trouble ticket by emailing ipv6@he.net (Hurricane Electric). HE didn't say what it could do, what proof it would want, or how long it would take. If you write in, include your account name and send the email from the address on the account. More in Lost the phone with your authenticator app?

Official Hurricane Electric help

• Frequently Asked Questions (Hurricane Electric IPv6)
• HE.net IPv6 Tunnel Broker Registration
• What is the "Two-Factor Authentication?" (forum thread with staff answers, 2015)
• Two-factor Authentication (staff announcement, 2016, edited 2018)
• Lost two-factor authentication information (forum thread with a staff answer, 2019)
• Hurricane Electric Network Tools