Namecheap 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Namecheap account is where your domains, hosting, SSL certificates and payment details live, so it deserves more than a password. Two-factor authentication (2FA) is optional and free. Namecheap offers two kinds: Device Authentication (U2F), which covers security keys, Face ID or Touch ID and passkeys, and Authentication app (TOTP), a six-digit code from an app (Namecheap, Namecheap). You get one or the other, not both: "It is not possible to use several 2FA methods simultaneously" (Namecheap). Turning on the app replaces a security key you already use.
This guide sets up the app method with Authenticator App - Novaz on iPhone. Any other authenticator app follows the same steps.
How we checked this guide: the Namecheap steps come from Namecheap's own Knowledgebase articles, linked below, which we read on October 20, 2026. We haven't tested them on a Namecheap account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
What changes when you turn it on
Without 2FA, Namecheap emails you a code each time you sign in from a new device or browser, to mark it as trusted. Namecheap says that setting up 2FA ends those email checks (Namecheap).
With the app on, you sign in with your username and password, then type the six-digit code from the app (Namecheap). Namecheap's pages don't mention a way to remember a device and skip the code.
This covers the Namecheap account itself. A cPanel hosting account has its own 2FA setting (Namecheap).
Turn on 2FA with an authenticator app
Namecheap's help describes these steps (Namecheap, Namecheap):
- Sign in to Namecheap. In the left sidebar, choose Profile, then Security.
- In the Access section, find Two-Factor Authentication and click Manage.
- For Authentication app (TOTP), click Enable. Type your Namecheap password and click Continue. If you already use a security key, Namecheap asks you to confirm the switch.
- Your backup codes come next, before the QR code. Print them or copy them somewhere safe, then click Next. They only start working once the setup is finished.
- Namecheap shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, click enter this text code to see the key. In Novaz, tap +, then Enter key manually. Put Namecheap in Service, your username in Account if you like, and the text code in Setup key. See What is a 2FA setup key?
- Type the six-digit code from Novaz into Namecheap, then click Next. The Two-Factor Authentication page now shows TOTP as your method.
Namecheap's codes have six digits and change every 30 seconds, the same settings Novaz uses for a typed key. Namecheap doesn't say how long the text code is, so scanning is the safer choice.
Namecheap lets you link several devices, but only during setup: scan the same QR code on each one before you click Next, and they'll all show the same code. Without a Novaz backup, its keys exist only on your iPhone, so a second device added now is a fallback besides the backup codes.
Your backup codes
In the Backup Codes section of the Two-Factor Authentication page, Show Backup Codes lists them after you enter your password. Used codes appear grayed out, because each one works only once. If the codes are lost, stolen or used up, open the drop-down there, choose Regenerate Backup Codes, then Regenerate, and confirm with your password. The old set stops working (Namecheap).
If you haven't made a Novaz backup (iCloud backup or a backup file), these codes are what gets you in if your iPhone is gone. Namecheap suggests keeping them in a password manager; paper in a safe place works too. More in 2FA backup codes.
If Namecheap rejects your code
Namecheap's advice is to make sure your device shows the correct time, and to type a code soon after it appears. Each code lasts 30 seconds and can't be reused after a successful sign-in (Namecheap).
On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
Don't keep guessing: a third wrong code in a row locks the account for 24 hours. The lock lifts on its own, and Support can help if it doesn't (Namecheap). After two failures, fix the clock or click Want to use a Backup Code? instead. Other causes are in Authenticator code not working?
Moving to a new iPhone
Namecheap's way to link a new device is to regenerate the QR code on the Two-Factor Authentication page, which asks for your password. Three things happen at once: the old QR code stops working, you get a new set of backup codes automatically, and you're signed out of Namecheap everywhere (Namecheap).
So do it while the old phone still works. Regenerate the QR code, scan it with Novaz on the new iPhone, and save the new backup codes. Any spare device you linked needs the new QR code too. Then delete the old entry on the old phone: open it in Novaz and tap Remove account. With Novaz's iCloud backup or a backup file, you can skip all this and restore your accounts on the new iPhone instead; see How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
At sign-in, click Want to use a Backup Code? and type one of your codes. Once you're in, regenerate the QR code as above to link your new phone.
Without backup codes, the help pages leave a gap: Namecheap doesn't describe a 2FA recovery process, what proof it wants, or how long it takes. Its 2FA articles send questions to the 24/7 Support Team on live chat, so that's where to start. More in Lost the phone with your authenticator app?
Turning 2FA off
Go to Profile > Security > Two-Factor Authentication > Manage and set it to OFF (Namecheap).
