Skip to content
Novaz AuthenticatorGET

osu! 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. What changes when you add an app
  2. Turn on authenticator app verification
  3. When osu! asks for a code
  4. No backup codes
  5. If osu! rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning it off
  9. Official osu! help

Your osu! account covers the rhythm game, the osu.ppy.sh website, the forums and beatmap uploads. Each time you sign in on a new session, osu! checks it's you with a code. By default that code arrives by email. Since September 2025 you can use an authenticator app instead (osu!). osu! calls this authenticator app verification rather than two-factor authentication, and it's optional. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: osu! has no help article on this feature yet. The osu! steps come from osu!'s own changelog, from pull requests written by osu! staff, and from the website's open-source code that osu! publishes on GitHub, all linked below, which we read on October 21, 2026. We haven't tested them on an osu! account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

What changes when you add an app

osu! doesn't add a step to sign-in. It swaps the source of a code you already enter: the Account Verification box asks for your app's code instead of an emailed one. The settings page says it directly: "Email verification will still be available as a fallback" (osu!). So anyone who can read your email can still get past the check. Keep your email account well protected.

Turn on authenticator app verification

These labels come from the website's code and a staff developer's screenshots of the feature (osu!, osu!):

  1. Sign in on osu.ppy.sh and open your account settings at osu.ppy.sh/home/account/edit.
  2. Scroll to the Authenticator App section, below the password and email sections. Its status reads Not configured.
  3. Select Add Authenticator App.
  4. Type your current password and select Continue.
  5. osu! shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  6. Below the QR code there's a link that copies the key. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
  7. Type the 6-digit code from Novaz in the box and select Finish.

The status changes to Configured. osu!'s code generates standard 6-digit codes that change every 30 seconds, so typing the key by hand in Novaz works (osu!).

When osu! asks for a code

The osu! website asks for verification whenever a signed-in session isn't verified yet, which in practice means each new sign-in (osu!). With an app set up, the box asks for the code from your authenticator app. It also offers a link to verify by email instead.

The game client osu!(lazer) supports app codes too. A staff developer removed the settings note saying lazer still verified by email in November 2025, once every lazer release had the support (osu!). osu!'s pages don't say whether osu!(stable) asks for the code.

No backup codes

osu! gives no backup or recovery codes. The email link in the sign-in box is your fallback, which matters with Novaz: unless you've made a backup, its keys stay on your iPhone.

If osu! rejects your code

osu! accepts each code only once. If you try the same code twice, osu! tells you it has already been used and to wait for a new one (osu!).

Otherwise, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. osu! only allows a few seconds of drift. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

osu! has no transfer option. If you use Novaz's iCloud backup or keep a backup file, restore your accounts on the new iPhone and the osu! codes keep working. Otherwise, while signed in, remove the app in Authenticator App (below), then select Add Authenticator App again and scan the new QR code with your new phone. More in How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

At the Account Verification box, choose the link to verify using email instead, and osu! sends a code to your email (osu!). Then remove the old app in settings and add it again.

If you can't get into your email either, osu!'s help centre says to contact its support team. Include the email address you registered with, any osu!store or osu!supporter receipts, and the last date you could sign in. Scores and replays don't help prove ownership. If you think someone else took your account, the address is accounts@ppy.sh (osu!). osu! doesn't say how long this takes. See also Lost the phone with your authenticator app?

Turning it off

In the Authenticator App section, select Remove, type your current password, and select Remove again. osu! confirms the app has been removed, and verification goes back to email (osu!). Removing it needs only your password, not a code. In Novaz, open the osu! account and tap Remove account.

Official osu! help

More guides: Gaming and betting