Skip to content
Novaz AuthenticatorGET

MEGA 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. First, back up your recovery key
  2. Turn on 2FA with an authenticator app
  3. When MEGA asks for a code
  4. If MEGA rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official MEGA help

Your MEGA account holds your files and chats (MEGA). Two-factor authentication (2FA) is optional, but MEGA recommends it (MEGA) and tells you to turn it on after any sign of a break-in (MEGA). Once it's on, you enter a 6-digit code from an authenticator app (MEGA). MEGA names Authy, Duo Mobile, Google Authenticator and Microsoft Authenticator as apps it recommends (MEGA). It doesn't offer codes by text message, because it considers SMS too easy to intercept or hijack (MEGA).

The unusual part is recovery. MEGA's help pages don't offer backup codes. Instead, MEGA calls your recovery key, which also resets a forgotten password, the only way to remove 2FA without your authenticator app (MEGA). So deal with that key first.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the MEGA steps come from MEGA's own Help Centre, its security page and its security white paper, linked below. We read every one of them directly on MEGA's sites on October 20, 2026, not in archived copies. We haven't tested them on a MEGA account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, back up your recovery key

The recovery key is a 22-character code. It can reset your password, or remove 2FA when you no longer have your authenticator app (MEGA). MEGA's security white paper, from June 2022, says you're made to export it when you turn on 2FA, if you never have (MEGA).

In a desktop web browser, click your profile image at the top right, then Download recovery key (MEGA). Print it or keep it in a password manager. MEGA advises against a screenshot or photo, since those often sync to the cloud (MEGA).

Turn on 2FA with an authenticator app

MEGA's Help Centre gives this path (MEGA). A computer is easiest, because Novaz can scan the QR code off the screen.

  1. In a desktop web browser, click your profile image at the top right, then Settings.
  2. Click Security in the left-hand panel, then Two-factor authentication (2FA).
  3. MEGA shows a QR code (MEGA). In Novaz, tap +, then Scan QR code, and point the camera at it.
  4. Type the 6-digit code from Novaz into MEGA. The white paper says 2FA only switches on once MEGA accepts a valid code.

In the iOS app, the setting is at Menu (bottom right) > Settings > Security > Two-factor authentication (MEGA). If the QR code is on the same iPhone as Novaz, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.

MEGA's pages don't mention a text key or what it's called. If you see one, you can tap +, then Enter key manually, and paste it as the Setup key. Scanning is safer, though: MEGA doesn't state how often its codes change, and the QR code carries those settings.

When MEGA asks for a code

At sign-in, and when you link a new computer, phone or tablet (MEGA). MEGA's security page adds changes to your account (MEGA), and the white paper names two of them: turning 2FA off and changing your account email (MEGA). MEGA's pages don't mention a way to remember a device.

If MEGA rejects your code

MEGA's advice is to let your phone set its clock automatically (MEGA). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

The white paper adds two details (MEGA). MEGA records the last code you used, so the same code won't work twice. And too many failed sign-ins or codes lock the account for an hour, so don't keep guessing. More causes are in Authenticator code not working?

Changing phones

MEGA's pages don't describe moving 2FA to a new phone. What they do cover is turning 2FA off, which takes a code from your current app (MEGA). So turn it off while you still have the old phone, then set it up again on the new one. If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead. Without one, do this before you give up the old phone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With your recovery key: go to the recovery page, or select Forgot password on a sign-in screen. Enter your email address and choose Yes, I have my recovery key (MEGA). MEGA emails you a link where you enter the key and set a new password (MEGA). Resetting the password this way also removes 2FA (MEGA). Then turn 2FA on again.

Still signed in somewhere, but no saved key: the key can only be exported while you're signed in (MEGA), so export it from that device now.

Neither: the Help Centre doesn't cover this. The 2022 white paper says MEGA staff can turn off 2FA if you show enough evidence that the account is yours, with a senior staff member's approval (MEGA). It doesn't say what evidence or how long it takes. Contact MEGA support.

Think twice about the recovery page's option to park your account and start over. You get a new, empty account under the same email, and the old data is kept for only 60 days (MEGA). More in Lost the phone with your authenticator app?

Turning 2FA off

Go back to Two-factor authentication (2FA) under Settings > Security and enter a code from your app one last time (MEGA). Then open MEGA in Novaz and tap Remove account.

Official MEGA help

More guides: Cloud storage and backup