Nominet 2FA: how to set up an authenticator app for Online Services

Nominet runs the .uk registry, and Online Services is the web portal its registrars use to manage domains on their tag, contacts, account settings and billing (Nominet). Two-factor authentication (2FA) isn't optional there: Nominet makes it mandatory for every registrar who signs in to Online Services (Nominet). It covers the web portal only. In Nominet's words, "Other systems and services such as EPP and DAC are not affected" (Nominet).

The only method Nominet documents is a time-based code from an authenticator app (RFC 6238). Its guide is written around Google Authenticator and also mentions Authy, but any app that follows the standard should work. This guide uses Authenticator App - Novaz on iPhone; other authenticator apps work the same way.

How we checked this guide: the Nominet steps come from Nominet's own Registrar Resources pages and its Two-Factor Authentication User Guide (a PDF), linked below, which we read on October 21, 2026. We haven't tested them on a Nominet account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Things to know first

• Codes are per device. Nominet registers each authenticator as a named device on your contact login. You can add more than one, and each one makes its own valid code. Nominet suggests five devices is plenty for one person (Nominet).
• No backup codes. The user guide doesn't mention any. A second device is the documented fallback.
• Eight wrong codes lock the account, and unlocking it means proving your identity to Nominet's support team.
• An old passphrase goes away. If your login had the extra passphrase step, Nominet removes it once 2FA is on.

Turn on 2FA with an authenticator app

Nominet's user guide describes this flow (Nominet). The PDF dates from 2019 and the web pages use slightly different menu names, so what you see may differ a little.

1. Sign in to Online Services with your email and password.
2. If Online Services prompts you to sign up to 2FA, click Yes. If there's no prompt, open Login settings and choose the option to add or manage 2FA devices. The account security page calls it 2FA – Add/manage devices (Nominet).
3. Online Services generates a setup key and shows a QR code. Give the device a name you'll recognize later, such as "Work iPhone", and click next.
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the code is on your iPhone's own screen, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. To type the key instead, tap +, then Enter key manually. Put "Nominet" in Service, your contact email in Account, and the 16-character key in Setup key. Nominet says the key never contains a zero or a one, so a character that looks like either is a letter. See What is a 2FA setup key?
6. Back in Online Services, type the 6-digit code from Novaz and click Activate 2FA.

Codes change every 30 seconds, which matches what Novaz uses for a typed key.

If you have several contact logins, you can keep all of them in Novaz. Use the Account field to tell them apart, because a code only works for the login it was set up for.

When Nominet asks for a code

Every time you sign in to Online Services, after your email and password (Nominet). Nominet doesn't describe a remember-this-device option.

If Nominet rejects your code

Nominet's troubleshooting advice is about time: type the code as soon as it appears, and check that the date, time and time zone on your phone are right and set automatically (Nominet). On iPhone, that's Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

Also check that you picked the entry for the right contact login. Nominet adds one more cause: if a colleague shares your contact email, they may have locked the account with wrong codes, and Online Services emails that address when it locks. More causes are in Authenticator code not working?

Adding or replacing a device

To add a device, sign in with 2FA, go to Login Settings, select Manage 2 Factor Authentication devices, then Add/manage devices, and repeat steps 3 to 6. To remove one, use Delete device on the same screen, pick the device by its name, and confirm (Nominet).

Nominet's way to replace a device is to delete the old one and add the new one. When you move to a new iPhone, add the new phone first while the old one still makes codes, then delete the old one. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead; without one, this is the route to use. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

If another device is registered on your contact login, sign in with it, open Login Settings > Manage 2 factor authentication devices, and delete the lost one. If you have no other device, contact Nominet's Customer Service team. Once they've verified your identity, they remove the lost device for you (Nominet). Nominet doesn't say what proof it asks for or how long this takes.

For the .uk domain family, Nominet's contact page lists support@nominet.uk and +44 (0) 330 236 9480, open 8:00am to 6:00pm UK time, Monday to Friday. Emails get a reply within one working day (Nominet). The older PDF gives a different phone number, so use the contact page.

Because there are no backup codes, registering a second device is the simplest protection. See also Lost the phone with your authenticator app?

Turning 2FA off

You can't. 2FA is mandatory for registrars using Online Services, and Nominet doesn't document a way to switch it off.

Official Nominet help

• Two-Factor Authentication user guide
• Two Factor Authentication - User Guide (PDF)
• Account security (UK namespace)
• Account security (gTLDs)
• Online Services
• Contacting Nominet