MyAnimeList 2FA: how to set up an authenticator app

MyAnimeList (MAL) holds your anime and manga lists, reviews and forum posts, and for some people a MAL Supporter subscription or Manga Store purchases. Two-factor authentication (2FA) has been available since December 2020 and is optional, though MAL recommends it. The method MAL describes is a temporary code from an authenticator app on your phone, with backup codes for when the phone isn't available. Its pages don't mention text-message or email codes (MyAnimeList, MyAnimeList).

MAL's documentation is short, so this guide also points out what it leaves open. We use Authenticator App - Novaz on iPhone in the steps, but any authenticator app works the same way.

How we checked this guide: the MyAnimeList steps come from MyAnimeList's Support page and a 2020 announcement posted on its forum by MAL's Lead Admin, both linked below, which we read on October 20, 2026. We haven't tested them on a MyAnimeList account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

The setting is on the website. The announcement describes it this way (MyAnimeList):

1. Sign in at myanimelist.net and open your Account Settings.
2. Click the Manage 2FA button at the top of the page.
3. Follow the directions MAL gives you.

MAL doesn't describe those directions. The current Support page only says to follow the instructions on the account settings page, so the screens may have changed since 2020 (MyAnimeList). To add MAL to Novaz:

• A QR code: in Novaz, tap +, then Scan QR code, and point the camera at it. If you're doing this on the iPhone that has Novaz, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
• A key to type: tap +, then Enter key manually, and fill in Service (for example, MyAnimeList), Account if you like, and Setup key. See What is a 2FA setup key?

If MAL asks for a code to finish, type the current 6-digit code from Novaz. MAL doesn't say how often its codes change, so scan the QR code if there is one: it carries the code settings with it.

Save the five backup codes

When you turn 2FA on, MAL gives you five backup codes. Each one works a single time (MyAnimeList). The announcement singles this step out and asks you to store them somewhere you can still reach if your phone breaks or goes missing (MyAnimeList).

Keep them even if you use Novaz. Its keys stay on your iPhone unless you've turned on iCloud backup or exported a backup file, so without one, a lost phone means the codes are what gets you back in. MAL's pages don't say whether you can make a new set later, so count how many you've used. More in 2FA backup codes.

Signing in with 2FA on

After your password, MAL asks for the 6-digit code from your authenticator app. To use a backup code instead, click enter an unused backup code instead on that screen (MyAnimeList). MAL's pages don't say whether you can mark a device as trusted, or how the official MyAnimeList app for iPhone and Android handles the code.

If MAL rejects your code

MAL has no advice of its own on this. Most rejected codes come from a phone clock that has drifted. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when the clock is 15 seconds or more off. Also check that you're reading the MyAnimeList entry in Novaz, not another account. Other causes are in Authenticator code not working?

If you lose your authenticator

Start with a backup code, as above. If the phone and the backup codes are both gone, MAL's Support page sends you to the Contact Customer Support button at the bottom of that page. Fill in the form with your registered email address, and put this line at the very top: "I cannot access my 2FA app and lost my backup codes" (MyAnimeList). Support answers in English only.

MAL asks you to add anything that helps prove the account is yours, but doesn't list what it accepts for this case. In its password-recovery section, the same page names receipts from MAL Supporter or Manga Store payments, and other email addresses or social accounts you've listed publicly on your profile. MAL doesn't say how long a 2FA reset takes. Since MAL wants the request made with your registered email address, make sure you can still get into that inbox. See also Lost the phone with your authenticator app?

New phone, or turning it off

MAL says the same account settings page is where you turn 2FA on and off (MyAnimeList). It doesn't describe moving to a new phone. While you still have the old phone, the straightforward route is to turn 2FA off in Account Settings, then turn it on again with the new phone. That's our suggestion, not MAL's. If you use Novaz's iCloud backup or a backup file, you can skip that and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

Official MyAnimeList help

• Support, section Two Factor Authentication (2FA)
• Two-Factor Authentication: Increase the security of your account (staff announcement, December 7, 2020)
• Account Settings (sign-in required)