Hushmail 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Hushmail is an encrypted email service popular with therapists and other small practices. Its two-step verification can text you a code, email one to a backup address, or take codes from a smartphone app (Hushmail). Hushmail's technical white paper says the codes are standard time-based ones and names Google Authenticator and Duo Mobile as examples of apps that work (Hushmail). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
One thing catches people out: once it's on, mail apps such as Outlook need a security code added to your password.
How we checked this guide: the Hushmail steps come from Hushmail's own help articles and its "Authentication and Encryption Design" white paper, linked below, which we read on October 21, 2026. We haven't tested them on a Hushmail account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Is it required?
For most accounts it's optional. On a Hushmail for Healthcare Growth plan, a domain administrator can ask Hushmail to enforce it from a chosen date. After that date, anyone who hasn't turned it on can't sign in until the administrator requests an extension, and Hushmail's Customer Care won't grant one to the user directly (Hushmail).
Turn on 2FA with an authenticator app
Hushmail's help article covers the first steps in webmail (Hushmail):
- Sign in to Hushmail webmail.
- Open the menu in the upper right corner and choose Preferences.
- Select the Security tab. Next to Two-step verification, click the pencil icon.
- Click Continue and follow the instructions on the screen. Choose the smartphone app as one of your methods.
The help article doesn't list the screens after that. The white paper fills in the rest: Hushmail shows a QR code for the app to scan, and each method you pick is confirmed by entering a valid code. It also says you have to pick at least two of the three methods, so expect to add a phone number or a backup email address as well (Hushmail). That white paper dates from 2018, so the screens may have changed since.
In Novaz:
- Tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code Novaz shows into Hushmail to confirm the app.
Hushmail's pages don't mention a text key or the code length, so scan the QR code: it carries the code settings to the app.
The backup verification code
With two-step verification on, the Security tab shows a Backup verification code. Hushmail's help says to keep it safe: it lets you in when you can't get codes from your phone or your other email address (Hushmail). Store it on paper or in a password manager, away from your iPhone. If the phone is lost and you have no up-to-date Novaz backup (iCloud backup or a backup file), this code and your second method are your way back in. More in 2FA backup codes.
Mail apps need a security code
Mail apps like Outlook and Apple Mail can't ask for a two-step code. Instead, at the bottom of the Security tab, the section Using a desktop or mobile email application shows a 20-character security code. In the mail app's password field, type your Hushmail password, a space, and then that code, keeping its spaces but adding none at the end. Some apps ask for it in both the incoming and outgoing server settings (Hushmail).
When Hushmail asks for a code
The Security tab describes the feature as asking for a code when you sign in from a computer Hushmail doesn't recognize (Hushmail). According to the white paper, a device you've verified is remembered for up to a year, and changing your password or turning two-step verification on or off makes every device verify again (Hushmail).
If Hushmail rejects your code
Go slowly: the white paper says Hushmail allows only 10 code attempts in 24 hours by default (Hushmail).
The usual cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If a mail app is the one failing, check that you added the security code after your password. Other causes are in Authenticator code not working?
Changing phones
Hushmail's pages don't explain how to switch the app to a new phone. The setting lives on the Security tab in webmail, so make the change there while you can still sign in, and keep the old phone until the new one shows codes Hushmail accepts. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead, and the codes stay the same. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use the backup verification code, or get a code by your other method: text message or backup email. Hushmail's help describes no other recovery route. Beyond that, contact Hushmail Customer Care. Hushmail's security white paper says its support staff follow strict rules and verify identities carefully before granting access, so don't count on a quick reset (Hushmail). See also Lost the phone with your authenticator app?
