Lemmy 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Lemmy isn't one website. It's open-source forum software run by many independent, connected servers called instances. Your account lives on the instance where you signed up, so two-factor authentication (2FA) is something you turn on there, and the people who can help you if it goes wrong are that instance's admins, not the Lemmy developers.
Lemmy has supported 2FA since version 0.18, released in June 2023. You store a secret in an authenticator app, and Lemmy then asks for a code from that app each time you log in (Lemmy). It's optional, and the official pages describe no other method, such as text messages or security keys. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Lemmy steps come from Lemmy's own documentation and release notes on join-lemmy.org, linked below, which we read on October 21, 2026. Those pages are thin on 2FA: they don't name the buttons, and we haven't tested the steps on a Lemmy account, so what you see may differ. Your instance may also run a different Lemmy version or a different web interface. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Lemmy's documentation says to open the top-right menu and go to settings for your account options (Lemmy). Since version 0.19.11 (April 2025), the standard web interface puts the 2FA (TOTP) settings in a card of their own on that page (Lemmy). Since version 0.19.0, turning it on takes two steps: Lemmy generates the secret first, and 2FA only switches on once you enter a valid code (Lemmy).
- Log in to your instance in a web browser, open the top-right menu and choose settings.
- Find the two-factor authentication card and start the setup, so Lemmy creates your secret.
- If Lemmy shows a QR code, in Novaz tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you only have the secret as text, tap +, then Enter key manually in Novaz. Type your instance's name as the Service, your username as the Account, and the secret as the Setup key. See What is a 2FA setup key?
- Type the code Novaz shows back into Lemmy to finish. Until you do, 2FA isn't on.
Lemmy's pages don't say whether it shows a QR code, a text key or both, or what code length and interval it uses. If there's a QR code, scan it: it carries those settings to the app. A key typed by hand always gets 6-digit codes every 30 seconds in Novaz.
The wording in these steps is ours, not Lemmy's. Lemmy's mobile apps come from other developers and may lack this setting, so use the browser.
Upgraded instances turned 2FA off once
When Lemmy 0.19.0 came out in December 2023, the 2FA rework switched it off for every user, partly so people who had locked themselves out with the old one-step setup could get back in (Lemmy). If you set up 2FA in 2023 and Lemmy no longer asks for a code, that's likely why. Check your settings and set it up again.
No backup codes
Lemmy's documentation and release notes don't mention backup or recovery codes. Unless you back up Novaz with iCloud backup or a backup file, its keys exist only on your iPhone, so losing that phone could leave you with no code at all. Before you rely on 2FA, find out how to reach your instance's admins.
If Lemmy rejects your code
Lemmy's pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones or turning 2FA off
Since 0.19.0, turning 2FA off requires a valid code, which closed a gap where it could be switched off without one (Lemmy). Lemmy doesn't document a separate way to move 2FA to a new phone, so do it while the old phone still works: turn 2FA off in settings with a code from the old phone, then set it up again on the new one. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Lemmy's official pages don't describe a recovery route for 2FA. The closest advice is for sign-up problems: the documentation says to get in touch with your instance's admin (Lemmy). The admins run the server your account lives on, so they're the people to ask. What proof they want, and whether they can help, is up to each instance.
One thing worth doing now: Lemmy lets you download a backup of your account data from the settings page, including followed communities, saved posts and blocks, and import it on another instance (Lemmy). It won't restore your account or your 2FA, but if you're locked out for good, you can start over elsewhere without losing your follows. More in Lost the phone with your authenticator app?
