Skip to content
Novaz AuthenticatorGET

mail.com 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. One secret key, no backup codes
  3. Where mail.com asks for a code
  4. If mail.com rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official mail.com help

Two-factor authentication (2FA) on mail.com is optional and protects your mailbox, calendar and address book (mail.com). The only second factor is a 6-digit code from an authenticator app. Setup also makes you confirm a mobile number by text message, but that number is for password resets, not sign-in codes (mail.com). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the mail.com steps come from mail.com's own help center and 2FA pages, linked below, which we read on October 19, 2026. We haven't tested them on a mail.com account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

On a computer, in a web browser, mail.com's help center describes these steps (mail.com):

  1. Click Account at the top right, then Security Options on the left.
  2. Under Two-factor authentication, click Activate two-factor authentication, then Start setup now.
  3. Enter your mail.com password and click Start now.
  4. Confirm your mobile number (use Change if the one shown is out of date). Click Request SMS, enter the code from the text, and click Continue.
  5. mail.com shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  6. Can't scan it? Click Copy code under the QR code. That copies the setup key. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
  7. Enter the 6-digit code from Novaz and click Continue.
  8. Click Save your secret key to download a PDF (more below). Check your personal information, click Next, then Activate now.

mail.com's codes have 6 digits and last 30 seconds (mail.com), the same settings Novaz uses for a typed key. Other mail.com pages start from the profile icon or My Account, so menu names may differ slightly.

If you message the copied code to yourself, as mail.com's help suggests (mail.com), delete that message afterward: anyone with the key can make your codes.

One secret key, no backup codes

There are no backup codes. Setup gives you a single secret key in a PDF, which mail.com recommends printing (mail.com). You don't type it at sign-in. You enter it during password recovery, and mail.com then turns 2FA off (mail.com). It's meant for a lost, broken or new phone, or a forgotten password (mail.com).

With Novaz, that secret key is your way back in if the phone is gone and you have no Novaz backup (iCloud backup or a backup file). Store the printout away from your phone. See 2FA backup codes.

Where mail.com asks for a code

  • In a web browser: every time you sign in, after your password (mail.com).
  • In the mail.com Mail app: once, after you turn on 2FA. Update the app first (mail.com, mail.com).
  • Outlook, Thunderbird and other POP3/IMAP programs: no codes. In Security Options, use Manage application-specific passwords > Create new application-specific password, and give the program that password, which mail.com shows only once (mail.com). You also have to switch POP3/IMAP access back on after turning on 2FA (mail.com).

If mail.com rejects your code

mail.com's help blames expired codes: wait for the next one and enter it right away (mail.com). Its blog adds: check that your phone's clock is right and that you picked the mail.com entry (mail.com). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?

Changing phones

mail.com's help doesn't describe moving the authenticator; it lists a new smartphone as a case for the secret key (mail.com). While you still have the old phone, it's simpler to turn 2FA off with a code from it (below) and set it up again on the new one. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

  1. Start mail.com's password recovery at password.mail.com. It works through the contact email address or mobile number saved in your account (mail.com).
  2. When asked, enter the secret key from your PDF. mail.com turns off 2FA and you choose a new password (mail.com).
  3. Sign in and set up 2FA again on your new phone.

Lost the PDF too? Check your downloads folder. Otherwise, customer support may turn off 2FA after a strict identity check that can fail. In mail.com's words, 2FA "cannot be instantly switched off" (mail.com). For this, mail.com relies on the contact details you confirmed during setup (mail.com), so keep them current. mail.com doesn't say what proof it asks for or how long this takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Open Security Options and scroll to Two-factor authentication. Click Deactivate two-factor authentication, enter your password, type the code from Novaz and click Continue (mail.com). Then open the mail.com entry in Novaz and tap Remove account.

Official mail.com help

More guides: Email