Skip to content
Novaz AuthenticatorGET

mailbox 2FA: how to set up an authenticator app for mailbox.org

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Two things to do first
  2. Turn on 2FA with an authenticator app
  3. When mailbox asks for a code
  4. If mailbox rejects your code
  5. If you lose your authenticator
  6. Changing phones or turning 2FA off
  7. Official mailbox help

The email service at mailbox.org goes by "mailbox" on its site and in its help center, and its web app is called mailbox Office. Two-factor authentication (2FA) is optional. mailbox offers two kinds: time-based codes from an authenticator app (TOTP), and a one-time password method it calls Login 2.0, which its help describes with a YubiKey and a PIN (mailbox, mailbox). This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the mailbox steps come from mailbox's own Knowledge Base, in English and German, including its screenshots, which we read on October 21, 2026. We haven't tested them on a mailbox account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Two things to do first

mailbox's help doesn't mention backup codes. Your safety net is the login recovery details you store in your settings, so add them before you turn on 2FA:

  1. In mailbox Office, click the gear icon in the top right, then All settings.
  2. Go to Security > Login recovery.
  3. Enter a mobile number, an alternative email address, or a password for phone support, and click Save (mailbox).

Second, think about your other apps. Once 2FA is on, programs such as Outlook, Thunderbird, DAVx⁵ or a phone's calendar and contacts apps can't sign in with your normal password anymore (mailbox). Each one needs its own password:

  • For mail over IMAP and SMTP, create one under All settings > Security > Email app-passwords (mailbox).
  • For calendar, contacts (CalDAV, CardDAV), WebDAV, Drive sync or Exchange ActiveSync, use All settings > Security > Application passwords (mailbox).

Copy an application password straight into its app: mailbox shows it only once. None of these passwords work for signing in on the web.

Turn on 2FA with an authenticator app

From mailbox's 2FA article and its screenshots (mailbox):

  1. In mailbox Office, click the gear icon and open All settings > Security > Two-factor authentication.
  2. Under Setup two-factor authentication with TOTP, type a name in Device name, such as "iPhone".
  3. mailbox shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  4. Below the QR code is the TOTP key, a text version of the same secret. If you can't scan, tap + in Novaz, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key?
  5. Type the 6-digit code from Novaz into TOTP code.
  6. Click Check code and activate TOTP. In the English screenshot, this button reads Check code and save, so yours may show either label.

A message confirms the setup, and your phone appears under Existing 2FA devices. mailbox's help doesn't say how often its codes change. Scanning the QR code is the safer choice, because it passes the code settings to your app.

When mailbox asks for a code

From now on, signing in on the web needs your password and a current code from Novaz (mailbox). Mail, calendar and Drive apps don't ask for codes. They use the app passwords you created above. The help doesn't mention trusted devices.

If mailbox rejects your code

mailbox's help has no advice for rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If a mail app stops connecting right after you turn on 2FA, that's a different problem: it needs an app password. More causes are in Authenticator code not working?

If you lose your authenticator

Without backup codes, the route back in is a password reset, and resetting your password also turns 2FA off (mailbox):

  1. Open Password Recovery and enter your mailbox's primary address. An alias won't work.
  2. Click Continue and pick one of the methods you stored: a code by SMS, a code to your alternative email address, or a call to support with your phone password (Monday to Friday, 9:00 to 18:00; mailbox reminds you to allow for time zones).
  3. Set a new password, sign in, and set up 2FA again.

This only works if you added recovery details beforehand. mailbox holds no other personal data to confirm the account is yours, so without them there's no reset. The German 2FA article agrees. The English version says instead that only an administrator can reset it. If someone administers your account, ask them. See also Lost the phone with your authenticator app?

Changing phones or turning 2FA off

To turn 2FA off, open Two-factor authentication again and click Delete and deactivate TOTP next to the device under Existing 2FA devices, as mailbox's screenshot shows. The help doesn't describe a phone switch. The safe order is to keep the old phone until you've removed the old entry and set up mailbox again on the new one. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

Official mailbox help

More guides: Email