Krystal 2FA: how to set up an authenticator app

Krystal is a UK web hosting company, and your Krystal account is the login for its client area, where you handle billing, domains and hosting plans. Two-factor authentication (2FA) for that login isn't set in the client area itself. It's managed in Krystal Identity, the sign-in platform Krystal built in-house, at identity.krystal.io (Krystal). Krystal calls 2FA optional but highly recommended (Krystal).

Krystal Identity offers two kinds of second step: an authenticator app and a physical security key such as a YubiKey. This guide covers the app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way. It doesn't cover cPanel or WHM, which have their own separate 2FA (Krystal).

How we checked this guide: the Krystal steps come from Krystal's own knowledge base, linked below, which we read on October 21, 2026. We haven't tested them on a Krystal account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Get to the 2FA settings

Krystal documents two ways in (Krystal):

• From the client area: sign in at krystal.io/client, click your initials at the top right, choose Security Settings, then Manage Two Factor Authentication in Krystal Identity.
• Directly: sign in at identity.krystal.io with the same email address and password you use for the client area (Krystal), then click Settings and Two-factor authentication.

Turn on 2FA with an authenticator app

1. On the Two-factor authentication page, click Set up an authenticator app.
2. Krystal shows a setup screen headed Scan this code with your Two-Factor Authentication (2FA) App, with a QR code and a text code you can type instead.
3. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot, then tap + and Choose a photo. See scanning a QR code on the same iPhone.
4. To type the text code instead, tap +, then Enter key manually. Put "Krystal" in Service, your email in Account if you like, and the code in Setup key. See What is a 2FA setup key?
5. Under Enter the code displayed in the app, type the current code from Novaz and click Link authenticator app.

Krystal says its codes are 6 digits and change every 30 seconds, so typing the text code works just as well as scanning (Krystal).

After this, every sign-in asks for a code from the app.

Save your recovery codes quickly

Recovery codes are a separate step on the same page. Click Generate your recovery codes, then Generate recovery codes. Krystal displays them for one minute only, so have a pen or your password manager open before you click (Krystal). The article doesn't say how many codes you get or whether making a new set cancels the old one.

Unless you back up Novaz with iCloud backup or a backup file, its keys live only on your iPhone, so keep these codes safe as your way back in. More in 2FA backup codes.

If Krystal rejects your code

Krystal's knowledge base has no advice for a rejected authenticator code. The common cause is a phone clock that has drifted. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Don't confuse it with the email code. The first time you sign in to Krystal Identity, Krystal emails you a verification code, which is a different thing from your authenticator code (Krystal).

Changing phones

Krystal doesn't describe a phone switch. Its steps do let you remove the authenticator app and add one again, so while you still have the old iPhone, you can remove the app in Krystal Identity and set it up again on the new one, then make fresh recovery codes. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a recovery code. If you have neither the app nor a recovery code, Krystal says to contact support, which starts what it calls an enhanced security procedure (Krystal). Krystal links that procedure to its ID requirements, which are (Krystal):

• a selfie of you holding your passport or photo card driving license, and
• a utility bill or bank statement from the last three months showing the account holder's name and address.

Other documents may be needed in special cases, such as a bereavement. ID has to be sent by email to contact@krystal.uk, not over live chat, and Krystal gives access only to the registered account holder. It doesn't say how long this takes. See also Lost the phone with your authenticator app?

Turning 2FA off

In Krystal Identity, go to Settings > Two-factor authentication. Under the Authenticator App heading, click Remove app. If you also registered a security key, remove it under Security Keys with Remove: 2FA is off only once no method is left (Krystal). Krystal urges you to set 2FA up again soon. In Novaz, open the Krystal entry and tap Remove account.

Official Krystal help

• How do I setup Two-Factor Authentication (2FA) in Krystal Identity?
• How do I log in to Krystal Identity?
• How do I login to my Krystal Client Area using Krystal Identity?
• I'm unable to access my Krystal Client Area
• Setting an account security question
• How do I setup Two-Factor Authentication (2FA) on my cPanel account