Modrinth 2FA: how to set up an authenticator app

Modrinth hosts Minecraft mods, modpacks and shaders. Players use the account to follow projects, and creators use it to publish and collect revenue. You sign in with Discord, GitHub, Microsoft, Google, Steam, GitLab or a password (Modrinth). Two-factor authentication (2FA) adds a code from an authenticator app on top. There are no text-message codes.

2FA is optional, but know the stakes first: if you lose your authenticator and your backup codes, Modrinth "generally cannot recover your account", and it can't move projects or revenue to a new one (Modrinth). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: Modrinth's help center covers 2FA in two short articles, so the Modrinth steps also come from its 2023 announcement and the screens in its open-source code on GitHub, all linked below. Today's copy of that announcement stops before the 2FA part, so we read an archived copy of the original on web.archive.org, saved August 11, 2023. We read everything on October 20, 2026, and checked the labels against the English text modrinth.com loads today. We haven't tested the steps on a Modrinth account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

The setting is under Account security in your account settings (Modrinth, Modrinth source):

1. Sign in at modrinth.com, open your settings and choose Account and security (the address is modrinth.com/settings/account).
2. Under Account security, next to Two-factor authentication, select Setup 2FA.
3. A Setup 2FA window shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. On the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. Below the QR code, Modrinth prints the secret in bold. To type it instead, tap +, then Enter key manually in Novaz. Put Modrinth as the Service, your email address as the Account, and the secret as the Setup key. See What is a 2FA setup key?
5. Select Continue. Under Verify code, type the 6-digit code Novaz shows, then select Continue again.
6. Modrinth lists your backup codes. Save them now (next section), then select Complete setup.

The codes are standard: 6 digits every 30 seconds, SHA-1 (Modrinth source), so scanning and typing give the same result. The QR code labels the account with your email address. Modrinth also emails you whenever your account's security settings change (Modrinth, archived).

Save the backup codes before you close the window

The source code makes six backup codes, and each one works once (Modrinth source, Modrinth). They appear only at this step. There's no button to show them again or make new ones; a fresh set comes only from removing 2FA and setting it up again.

Unless you turn on Novaz's iCloud backup or export a backup file, its keys exist only on your iPhone, so these codes may be your only way back in. Keep them in a password manager or on paper, away from your phone. More in 2FA backup codes.

When Modrinth asks for a code

Every new sign-in asks for a code, with a password or with a linked account such as Discord or GitHub (Modrinth, archived, Modrinth source). On the Two-factor authentication step, type the code from Novaz, or choose Use a backup code. The exception is Continue with passkey: in the source code, a passkey sign-in skips the authenticator code. Modrinth's help doesn't cover passkeys.

If Modrinth rejects your code

Modrinth's help doesn't cover this. The source code shows two things:

• Modrinth accepts the current code and its neighbors, so the iPhone's clock only has to be close. If it's further off, turn on Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
• A code that just worked can't be used twice. Wait for the next one.

Other causes are in Authenticator code not working?

Turning 2FA off or changing phones

To turn it off, select Remove 2FA under Account security, type a code from Novaz or a backup code under Enter two-factor code, and select Remove 2FA (Modrinth source).

Modrinth's help doesn't describe a phone change. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone. Without one, while you still have the old phone, remove 2FA, then select Setup 2FA again and scan the new QR code on the new iPhone. You get six new backup codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with Use a backup code. Backup codes also let you turn 2FA off (Modrinth), so remove it and set it up again on your new phone.

Without backup codes, support will deny recovery requests. The one exception is an active Modrinth Servers or Modrinth+ subscription, if you can give the details of the card on file. Otherwise you'll need a new account, and Modrinth can't transfer data, projects or revenue from the locked one (Modrinth). Requests go through the Modrinth Help Center. Modrinth doesn't say how long they take.

More in Lost the phone with your authenticator app?

Official Modrinth help

• Adding two-factor authentication
• Lost two-factor authenticator
• Add more authentication methods to an account
• Launcher, Auth, Threads, Oh My! Modrinth Features, Ready to Fly (Modrinth's blog, August 2023, archived copy; now shortened at Introducing Modrinth App Beta)
• Modrinth's source code on GitHub: account settings screen, sign-in and 2FA server code, English interface text