itch.io 2FA: how to set up an authenticator app

Your itch.io account holds your indie game purchases and, if you make games, your project pages and payouts. Two-factor authentication (2FA) is optional, and there's only one kind: codes from an authenticator app (TOTP). itch.io doesn't send codes by text message and says it won't add SMS, because NIST has deprecated it (itch.io). When itch.io launched 2FA, it urged sellers in particular to turn it on, to help protect their payout settings if someone gets their password (itch.io). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the itch.io steps come from itch.io's own documentation and announcements, linked below, which we read on October 19, 2026. One detail comes from a staff reply on itch.io's community forum, and we say where. We haven't tested the steps on an itch.io account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

itch.io's documentation keeps it short: the setup is in the Security tab of your user settings (itch.io).

1. Sign in on the itch.io website and open the Security tab in your settings. When you're signed in, the Set up two-factor authentication button on itch.io's 2FA help page takes you to the same setup page.
2. itch.io shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
3. If you can't scan it, itch.io's launch post says you can type the code into your app instead (itch.io). Its pages don't say what the text key is called on screen. In Novaz, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
4. Finish with the instructions on the Security tab. itch.io's documentation doesn't list them, so we don't name buttons we couldn't confirm.
5. Save the recovery codes itch.io gives you (next section).

itch.io's codes are 6 digits and change every 30 seconds (itch.io). Novaz uses the same settings for a typed key, but needs one of at least 16 characters. If it won't take the key, scan the QR code.

Recovery codes are itch.io's only fallback

Turning on 2FA generates a set of 8-digit recovery codes. They let you sign in without your phone, and itch.io's advice is to "print them and keep them with you" (itch.io). The 2015 launch post mentioned five one-time codes (itch.io); the current page gives no number.

itch.io documents no other way back in: no SMS, no email fallback, no security keys. Novaz keys stay on your iPhone unless you turn on iCloud backup or export a backup file, and even a backup can be out of date, so keep these codes. Keep them away from the phone, on paper or in a password manager. itch.io's pages don't say whether you can generate a new set. More in 2FA backup codes.

When itch.io asks for a code

Once 2FA is on, signing in needs your password plus a 6-digit code from the app (itch.io). The documentation doesn't mention remembering trusted devices.

The itch desktop app sends you to the itch.io website to sign in, and that's where you type the code before you authorize the app (itch.io).

itch.io may also email you a verification code in some cases, separate from your authenticator code. In a staff reply on the itch.io forum, leafo, itch.io's founder, said a missing itch.io email usually means your mail provider rejected it, or you once marked an itch.io email as spam (itch.io forum).

If you sign in with GitHub (itch.io), itch.io's pages don't say whether it also asks for your code.

If itch.io rejects your code

itch.io's help names the cause: the codes depend on the time, so a phone clock that's off from the server's time makes them fail (itch.io). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

itch.io's pages don't describe moving 2FA to a new phone, or turning it off. In Novaz, an iCloud backup or backup file lets you restore your accounts on the new iPhone. Without one, keep the old iPhone until you've set up itch.io again on the new one, through the Security tab while you can still get a code. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your recovery codes. Without them, contact itch.io support at support@itch.io. Write from an email address that owns the account: itch.io says it can't process account requests otherwise. You'll get a receipt email with a ticket ID to quote whenever you talk to staff about it (itch.io).

itch.io doesn't say what other proof it asks for or how long a recovery takes. More in Lost the phone with your authenticator app?

Official itch.io help

• Secure your account with 2FA
• Two factor authentication now available
• Support & contact
• Logging in · The itch.io app book
• Register and log in with GitHub
• 2FA not working (community forum thread with a staff reply)