Keeper 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Keeper is a password manager, so its vault holds the keys to your other accounts. Two-factor authentication (2FA) is optional for personal accounts, but a business administrator can make it mandatory and choose which methods are allowed (Keeper). Keeper supports text messages, an authenticator app, Keeper DNA on a smartwatch, FIDO2 security keys, and, for business customers, Duo and RSA SecurID (Keeper). This guide covers the authenticator app option with Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Keeper steps come from Keeper's own documentation and website, linked below, which we read on October 21, 2026, using the plain-text versions that Keeper's docs site publishes for each page. We haven't tested them on a Keeper account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Two kinds of codes in Keeper
Keeper can hold one-time codes for your other accounts inside vault records, with Add Two-Factor Code (Keeper). This guide is about the code that protects the Keeper vault itself. Keeper's pages don't say whether you may store that code in Keeper, but a code locked inside the vault can't help you open the vault. Keep it in a separate app such as Novaz.
Turn on 2FA in the web vault or desktop app
Keeper's web vault guide gives these steps (Keeper):
- Click your email address in the upper-right corner to open the Account Dropdown Menu, then go to Settings > Security.
- Turn on Two-Factor Authentication and pick a method.
- Turn on Authenticator App and click Next.
- Keeper shows a QR code. In Novaz, tap +, then Scan QR code.
- Keeper also offers a secret key to type by hand. Its pages don't say how often the codes change, so scanning is the safer choice: the QR code carries the code settings. If you do type it, tap +, then Enter key manually in Novaz, and paste the key into Setup key. See What is a 2FA setup key?
- Enter the verification code from Novaz and click Next.
- Keeper then shows backup codes. Save them, then click I have written these codes down.
Keeper's enterprise page lists the menu the other way round, as Security > Settings, and calls the method Google and Microsoft Authenticator (TOTP) (Keeper). The labels you see may differ.
Turn it on in the Keeper app for iPhone
From Keeper's iOS guide (Keeper):
- Tap Settings > Two-Factor Authentication and select Authenticator App, then tap Save.
- Choose how long the code stays valid and tap Back.
- Keeper shows a QR code and a secret key. Because Keeper and Novaz are on the same phone, either take a screenshot and use + > Choose a photo in Novaz (same-iPhone QR codes), or copy the key and paste it with Enter key manually.
- Back in Keeper, enter the TOTP code from Novaz.
- Save the backup codes Keeper shows, then tap OK.
How often Keeper asks
During setup you pick how long a code stays good. On iPhone, a 2FA Frequency setting under Settings lets you change this later: every login, every 12 hours, every 24 hours, every 30 days, or never again on that device (Keeper). If you don't change it, Keeper asks every time you sign in. A business administrator can require a code on every login.
On a device Keeper doesn't recognize, you first approve the device (by email, Keeper Push or your 2FA method), then enter your code, then your master password (Keeper).
Backup codes and security keys
Your backup codes work in place of an authenticator code. They're your way in if you lose the phone and have no Novaz backup, or only one made before you added Keeper. Keep them outside your Keeper vault, on paper for example. See 2FA backup codes.
If you add a security key, Keeper's enterprise page asks you to keep another method as a fallback and recommends an authenticator app over text messages for that role (Keeper).
If Keeper rejects your code
Keeper's pages don't cover rejected authenticator codes. Check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones or turning 2FA off
Keeper documents no way to move an authenticator to a new phone. In a troubleshooting note, it describes turning 2FA off under Settings > Two-Factor Authentication in the iPhone app and setting it up again, which gives you a new set of backup codes (Keeper). Do it while the old phone still works. With a Novaz iCloud backup or backup file, you can restore Keeper on the new iPhone instead; without one, you add Keeper again there. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Keeper's 2FA page lists three ways back in: a backup code, a device you've already approved, or your admin, if your company has turned on recovery (Keeper). Business administrators can reset 2FA for their users in the Admin Console. If you can't find your backup codes, Keeper points you to its support page (Keeper). Keeper doesn't say what proof support asks for or how long it takes.
Keeper's 24-word recovery phrase is for a forgotten master password (Keeper). Its pages don't say it gets you past 2FA. More in Lost the phone with your authenticator app?
