Skip to content
Novaz AuthenticatorGET

Mastodon 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Save your 10 recovery codes
  3. Signing in from now on
  4. If Mastodon rejects your code
  5. Moving to a new iPhone
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official Mastodon help

Mastodon isn't one website. Your account lives on a single server, and the people who run that server set its rules (Mastodon). mastodon.social is the flagship, one of two servers the Mastodon team runs itself. On any server with current Mastodon software, two-factor authentication (2FA) starts with an authenticator app, and security keys can be added after that. There's no text-message option (Mastodon source). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

2FA is usually optional. Since Mastodon 4.6, released in June 2026, a server's admins can require it for a role, or for everyone (Mastodon), and the Mastodon team has said it plans to strongly recommend this for admins and moderators (Mastodon). If your server requires it, the 2FA page tells you, and you can't use the account until it's set up (Mastodon source).

How we checked this guide: Mastodon's documentation gives 2FA a single line, so the Mastodon steps also come from Mastodon's blog and from the screens in its own source code on GitHub (version 4.7.3, the latest release), all linked below. We read them on October 20, 2026, and checked that the 2FA screens are the same in the development version mastodon.social runs. We haven't tested them on a Mastodon account, and servers on older or modified versions may differ, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

The 2FA settings sit with your email and password settings on your server's website, so use a browser (Mastodon, Mastodon source):

  1. Sign in to your server on the web, for example at mastodon.social, and select Preferences in the menu.
  2. In the settings menu, under Account, select Two-factor Auth.
  3. Select Set up. On the Confirm password to continue screen, type your password and select Continue. Mastodon won't ask for it again for an hour.
  4. Mastodon shows a QR code. In Novaz, tap +, then Scan QR code. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  5. If you can't scan it, use the plain-text secret printed next to the code, split into groups of four characters. In Novaz, tap +, then Enter key manually, and type it as the Setup key. Spaces don't matter, but the key is long, so scanning is less error-prone. See What is a 2FA setup key?
  6. Type the current code from Novaz in Two-factor code and select Enable.
  7. Mastodon shows your recovery codes on the next page. Save them before you leave it.

The QR code names the entry after your server's domain and your sign-in email address (Mastodon source). Afterwards, the page says Two-factor authentication is enabled. Only now can you add Security keys too (Mastodon source).

Save your 10 recovery codes

You get 10 recovery codes, and each works once (Mastodon source). Mastodon suggests printing them and keeping them with your important documents (Mastodon source). Keep them even if you use Novaz: unless you turn on iCloud backup or export a backup file, its keys exist only on your iPhone.

For a fresh set, select Generate recovery codes on the Two-factor Auth page. The old codes stop working at once, and Mastodon emails you about the change (Mastodon source). See 2FA backup codes.

Signing in from now on

After your email address and password, Mastodon asks for a Two-factor code every time. The same box takes a recovery code. Its sign-in screens have no option to remember a device (Mastodon source).

Apps sign you in by opening your server's sign-in page in a browser (Mastodon), so you type the code there when you add your account to an app.

If Mastodon rejects your code

During setup, a wrong code brings up an error that asks, "Are server time and device time correct?" (Mastodon source). At sign-in, the message is Invalid two-factor code. Try too many codes within an hour and Mastodon shows Too many authentication attempts, try again later. Each new try restarts that hour, so stop and wait (Mastodon source).

Fix the iPhone's clock with Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. If you have accounts on several servers, check you're reading the entry for the right one. More causes are in Authenticator code not working?

Moving to a new iPhone

Do this while the old phone still works. On the Two-factor Auth page, select Edit next to Authenticator app and confirm your password. Scan the new QR code with Novaz on the new iPhone, enter a code and select Enable. Until you do, the old setup keeps working. Once you do, the old phone's codes and your old recovery codes stop working, and Mastodon shows a new set to save (Mastodon source).

If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead, and your codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your recovery codes, then set up Novaz again with Edit.

Without a recovery code, only your server's staff can help. Its admins can turn 2FA off for your account, from the admin pages or with Mastodon's command-line tool (Mastodon source, Mastodon). If your server lists a contact address, the screen that asks for your code shows it (Mastodon source). mastodon.social's is staff@mastodon.social (mastodon.social).

Neither Mastodon's documentation nor mastodon.social says what proof the staff ask for or how long it takes, and other servers set their own rules. More in Lost the phone with your authenticator app?

Turning 2FA off

On the Two-factor Auth page, select Disable 2FA and confirm your password. This removes the authenticator app, your recovery codes and any security keys together (Mastodon source), and Mastodon emails you. The button isn't there if your server requires 2FA for your role.

Official Mastodon help

More guides: Messaging and social