Mozilla account 2FA: how to set up an authenticator app

Your Mozilla account, called a Firefox account until November 2023, is the sign-in for Firefox Sync, Firefox Add-ons, Mozilla VPN and other Mozilla services (Mozilla, Mozilla). Mozilla calls 2FA two-step authentication. The second step is a code from an authenticator app, and a phone number can only be a fallback (Mozilla).

Plan your backup first: if you lose the app and every recovery method, Mozilla won't remove two-step authentication, and your synced data stays out of reach (Mozilla).

It's optional unless you build extensions: since March 15, 2021, addons.mozilla.org has required it for developers. Uploads made only through the AMO API with API keys don't ask for a code (Mozilla). The steps below use Authenticator App - Novaz on iPhone, but Mozilla takes codes from any authenticator app.

How we checked this guide: the Mozilla steps come from Mozilla's own help pages and blogs, linked below, and from the text of the Mozilla account settings screens, which we read on October 20, 2026. support.mozilla.org turned away our automated reader, so we read its articles as archived copies on web.archive.org, saved in May and June 2026. We haven't tested the steps on a Mozilla account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on two-step authentication

From Mozilla's help article and the current settings screens (Mozilla, Mozilla):

1. Sign in to your account settings at accounts.firefox.com, or click your account in the Firefox toolbar and choose Manage account.
2. Under Security, click Add next to Two-step authentication. Mozilla may ask you to confirm your session first.
3. On Connect to your authenticator app, a QR code appears. In Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and use Choose a photo instead (how).
4. Can't scan? Click Can’t scan QR code? to see a setup key under Enter code manually. In Novaz, tap +, then Enter key manually, put Mozilla in Service, and type the key into Setup key. Account is optional (more on setup keys).
5. Type the code from Novaz into Enter 6-digit code and click Continue.
6. Set up a recovery method (next section). Setup isn't complete without one.

The help article calls the step 4 link Can’t scan code?, so labels may differ. Mozilla doesn't publish its key length or code interval, so scan the QR code if you can. A typed key gives 6-digit, 30-second codes in Novaz.

Choose a recovery method

Most people are shown backup codes here. Some get Choose a recovery method, with two options (Mozilla):

• Backup authentication codes, marked Safest: one-time, 10-character codes. Download, copy or print them, click Continue, enter one, then Finish.
• Recovery phone, marked Easiest: a code by text message. It's for US and Canadian numbers only, still rolling out, and Mozilla warns about SIM swap attacks.

With Novaz, take the codes. Its keys stay on your iPhone unless you've made an iCloud backup or a backup file, and the codes still get you in if that backup is missing or out of date. Store them off the phone. Create new codes in settings replaces them later (Mozilla). See 2FA backup codes.

When setup finishes, Mozilla suggests signing out everywhere you use the account and signing back in with a code.

When Mozilla asks for a code

After your password, you'll see Enter two-step authentication code (Mozilla). Devices signed in earlier can ask too, since they haven't used a code yet. A password reset needs a code or recovery method too. Mozilla describes no remember-this-device option.

If Mozilla rejects your code

Two of Mozilla's tips apply here (Mozilla). Make sure you're reading the right entry, which may carry the name Firefox. Then check the clock on both devices; on iPhone: Settings > General > Date & Time > Set Automatically. Novaz flags a clock 15 seconds or more off. Other causes: Authenticator code not working?

Changing phones

Do this before you wipe the old phone. Settings now offer Change next to Two-step authentication, which shows a new QR code and retires the old app (Mozilla). Mozilla's older help article says to click Disable and set it up again, which voids your old recovery codes (Mozilla). Either way, scan the new code with Novaz on the new iPhone. With Novaz's iCloud backup or a backup file, you can skip this and restore your accounts on the new iPhone instead (details).

If you lose your authenticator

Mozilla offers three ways back in (Mozilla):

1. A device still signed in. Open account settings there and click Disable next to Two-step authentication, then confirm.
2. A backup code. At the code prompt, click Trouble entering code?, pick backup codes if asked, and enter one. Lost them? Search your devices and cloud storage for <your email> backup authentication codes.txt.
3. A recovery phone. Same link, pick the phone, and enter the six-digit code from the text.

Once in, Mozilla has you click Disable under Security. Then set it up again with Novaz.

With none of these, Mozilla is blunt: "deactivation by Mozilla of two-step authentication is not supported." Your existing Sync data is out of reach, and Mozilla can't delete the account because it can't verify you own it. It suggests a new account with another email address, and asking support to cancel subscriptions. Add-on developers should contact support; Mozilla doesn't say what proof it needs or how long it takes. See Lost the phone with your authenticator app?

Turning it off

Under Security, click Disable next to Two-step authentication, then Disable in the Disable two-step authentication? prompt (Mozilla). Then open the entry in Novaz and tap Remove account.

Official Mozilla help

• Set up two-factor authentication on your Mozilla account
• What if I'm locked out of Two-Step Authentication?
• Change your two-step authentication device for your Mozilla account
• Access Mozilla services with a Mozilla account
• Two-factor authentication required for extension developers, Mozilla Add-ons Community Blog
• Why we’re renaming ‘Firefox accounts’ to ‘Mozilla accounts’, Mozilla blog