Packagist.org 2FA: how to set up an authenticator app

Packagist.org is the public repository Composer installs PHP packages from, and you need an account there to submit or maintain a package. Two-factor authentication (2FA) is optional for now. In May 2026, Packagist.org's blog asked every maintainer to turn it on, said 2FA status will show on maintainer profiles, and said 2FA will become mandatory for all accounts, with no date set yet (Packagist).

Today the only method is an authenticator app; the same post mentions plans for FIDO2 security keys. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way. The setup page itself names 2FAS, Google Authenticator and KeePassXC as examples (Packagist source).

How we checked this guide: Packagist.org has no help center. The Packagist.org steps come from its contact page, its blog and its source code on GitHub, which its About page links to. All are linked below, and we read them on October 20, 2026. We haven't tested them on a Packagist.org account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

From the Packagist.org source code (Packagist source, Packagist source):

1. Sign in at packagist.org and select your username at the top.
2. In your profile menu, select Two-factor auth. The page says two-factor authentication is currently disabled.
3. Select Enable two-factor authentication.
4. Packagist.org shows a QR code. In Novaz, tap +, then Scan QR code. If the page is open on the same iPhone, take a screenshot, tap + and use Choose a photo. See scanning a QR code on the same iPhone.
5. Under the QR code is a TOTP Key. To type it instead, tap +, then Enter key manually, and enter it as the Setup key. Packagist.org uses standard codes, 6 digits every 30 seconds, so a typed key works as well as a scanned one (Packagist source). See What is a 2FA setup key?
6. Type the current code from Novaz in Code shown in authenticator: and select Enable Two-Factor Authentication.
7. The next page, Save your backup code, shows your backup code once. Store it, then select I have saved the backup code.

One backup code, and it turns 2FA off

You get a single one-time backup code, not a list. If you type it at the code prompt, Packagist.org signs you in and switches two-factor authentication off for your account (Packagist). A notice then asks you to turn it back on (Packagist source). The source code has no way to view or replace the code while 2FA stays on: you get a new one only by setting 2FA up again.

Two more things to know:

• A forgotten password is reset with a Two-Factor Code from your app (Packagist source). The contact page says the backup code can't stand in for it (Packagist).
• Unless you've made a Novaz backup, its keys exist only on your iPhone, so the backup code is your way back in. Keep it in a password manager or on paper. See 2FA backup codes.

When Packagist.org asks for a code

After your password, or after Log in with GitHub, a Two-Factor Authentication page asks for an Authentication code:. Tick Trust this computer for 30 days to skip the prompt in that browser for a month (Packagist source, Packagist source).

If Packagist.org rejects your code

From the source code (Packagist source, Packagist source):

• A code works only once. If you just used one, wait for the next.
• The clock margin is small. Packagist.org allows about 10 seconds of drift. Novaz only warns at 15 seconds, so set the iPhone's clock even without a warning: Settings > General > Date & Time > Set Automatically.
• Five wrong codes lock you out for 15 minutes. The page then says Too many authentication failures. Try again in 15 minutes.

More causes are in Authenticator code not working?

Changing phones or turning 2FA off

There's no transfer option. While you can still sign in, open Two-factor auth, select Disable two-factor authentication, and confirm with the button of the same name. No code is needed (Packagist source). Then set it up again on the new phone and save the new backup code. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead and skip this. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

The backup code page warns that losing both the app and the code means losing the account for good (Packagist source). Since September 2026, though, Packagist.org has a reset request (Packagist):

1. Backup code. Enter it in place of the code. 2FA turns off, and you can set it up again.
2. No backup code. Sign in as usual and select Request a reset on the code prompt. On Request a two-factor reset, optionally fill in Anything that helps us verify you (optional), then select Request a reset (Packagist source).
3. Forgot the password too. The reset link only appears after your password is accepted, so email contact@packagist.org instead.

An admin reviews each request by hand and replies to your account's email address. That address also gets an email as soon as the request is filed, with a link to cancel it if someone else made it (Packagist source). Packagist.org doesn't say how long a review takes. The source code adds a 24-hour wait before approval if you belong to an organization or maintain a package with 10,000 or more downloads (Packagist source).

More in Lost the phone with your authenticator app?

Official Packagist.org help

• Contact - Packagist.org
• About Packagist.org
• An update on Composer & Packagist supply chain security
• composer/packagist, the Packagist.org source code