Lichess 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Lichess is the open-source chess site at lichess.org (Lichess). Its two-factor authentication (2FA) comes in one form: a code from an authenticator app, asked for each time you sign in with your password (Lichess). There are no text-message codes and no backup codes. If you lose the app, the way back in is a password reset by email, which switches 2FA off (Lichess). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: Lichess has no help article on 2FA, so the Lichess steps come from its contact page, FAQ, an official blog post, and its source code on GitHub (linked from the FAQ), which gave us the screen labels. The blog post blocks automated access, so we read an archived copy on web.archive.org, saved March 6, 2026. We read everything on October 20, 2026. We haven't tested the steps on a Lichess account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Is it required?
For most players it's optional. The source code shows two exceptions:
- Accounts with extra responsibilities, such as titled players, team leaders, coaches, teachers and streamers, can get a message asking them to turn it on (Lichess source).
- Risky connections. Signing in with a password through Tor or a public proxy, or from a browser Lichess considers dangerously out of date, fails without 2FA: "2-Factor Authentication is required to log in from this network." (Lichess source). Paid VPNs don't count (Lichess source).
Turn on 2FA with an authenticator app
On lichess.org in a browser (Lichess source):
- Sign in, select your username at the top right, then Preferences.
- In the menu, select Two-factor authentication. (The blog post links straight to lichess.org/account/twofactor.)
- Any authenticator app works, not just the ones Lichess suggests. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If it's on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Can't scan it? The secret key is in the sentence under the QR code, printed black on black so it looks like a bar. Highlight it to read it, or copy it. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
- Type your Password and the 6-digit Authentication code from Novaz, then select Enable two-factor authentication.
The page then reads Two-factor authentication enabled. Typing the key works fine: Lichess uses a 32-character key and standard codes, 6 digits every 30 seconds (Lichess source). It also ends your other sessions, so you'll sign in again, with a code, on other devices (Lichess source).
Your email is the backup, and the weak spot
The setup page's only fallback is a Password reset by email. Unless you've made a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, so if that phone is gone, your account's email is your way back in.
That cuts both ways. A completed password reset turns 2FA off, and the source code shows that the Log in by email link on the sign-in page doesn't ask for an authenticator code either (Lichess source). Lichess's blog post warns that anyone who gets into your email can reset your passwords, and suggests 2FA on the email account too (Lichess). Keep the address under Change email current.
Signing in
After your password, Lichess shows an Authentication code field for the code from Novaz (Lichess source). There's no trusted-device option, but Keep me logged in keeps that browser signed in.
If Lichess rejects your code
A wrong code shows Invalid code. Lichess accepts codes up to three 30-second steps early or late (Lichess source), so the clock has to be off by more than about a minute and a half to cause this. Check that you used the Lichess entry and the newest code, then the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones or turning 2FA off
There's no transfer step. While the old phone still works, open Two-factor authentication in your preferences, enter your Password and a current Authentication code, and select Disable two-factor authentication (Lichess source). To use a new phone, set it up again; Lichess makes a new key each time. With a Novaz iCloud backup or backup file, you can skip this and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
The contact page covers this under I can't log in > I lost access to my two-factor authentication codes: complete a password reset (Lichess). From the source code (Lichess source):
- On the sign-in page, select Password reset.
- Enter the Email on your account and select Email me a link. Lichess sends at most three reset emails per address per day.
- Open the link, which expires after 10 minutes. Type a New password, repeat it in New password (again), and select Change password.
That turns 2FA off, signs you out everywhere else and signs you in; set up the authenticator again right away. Lichess asks for no proof beyond that email, and its help pages describe no way back in without it. More in Lost the phone with your authenticator app?
