Skip to content
Novaz AuthenticatorGET

Philipps-Universität Marburg 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Scan the QR code, don't type the key
  2. Set up your first app token (new students)
  3. Add an app token when you already have one
  4. If your token came by post
  5. Make backup TANs now
  6. Entering the code
  7. If Marburg rejects your code
  8. Changing phones
  9. If you lose your phone
  10. Deleting an old token
  11. Official Philipps-Universität Marburg help

At Philipps-Universität Marburg, your Uni-Account needs a second factor for the university's protected services, such as Marvin, ILIAS, time recording and GitLab (Uni Marburg), as well as VPN and webmail (Uni Marburg). The HRZ (the computing center) calls each second factor a token. Students set up their own, staff get a YubiKey automatically, and guests apply for one by form (Uni Marburg).

The everyday option for most people is the App-Token: time-based codes (TOTP) from an authenticator app. Marburg's codes are unusual: 8 digits with the SHA-512 algorithm. That's why the HRZ says Google Authenticator and Microsoft Authenticator no longer work (Uni Marburg). Its own recommendations are the Uni Marburg app and 2FAS. This guide uses Authenticator App - Novaz on iPhone, which reads 8-digit SHA-512 settings from a QR code. Other authenticator apps work the same way if they support those settings.

How we checked this guide: the Marburg steps come from the HRZ's own help pages, linked below, which we read on October 21, 2026. We haven't tested them on a Uni-Account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Scan the QR code, don't type the key

When you type a key by hand, Novaz always makes 6-digit SHA-1 codes, and Marburg won't accept those. A QR code carries the code length and algorithm with it, so always add Marburg by scanning. After scanning, the code in Novaz should have 8 digits. If it has 6, remove the account and scan again.

The portal and the activation letter also show a secret key, meant for desktop apps where you set SHA-512 and 8 digits yourself (Uni Marburg).

Set up your first app token (new students)

If you don't have any token yet, use the initial issue in the 2FA portal (Uni Marburg):

  1. Open the 2FA portal and choose Initialen Token für Studierende (in English, Initial token for students).
  2. In step 1, accept the terms of use and click Weiter.
  3. In step 2, fill in the form completely, then click APP-Token auswählen.
  4. A QR code appears. In Novaz, tap +, then Scan QR code, and point the camera at it. If the portal is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  5. Type the 8-digit code from Novaz into the portal and confirm.

Confirm right away: unconfirmed app tokens are removed after an hour.

Add an app token when you already have one

Staff with a YubiKey, or anyone moving from an older token, add an app token from inside the portal (Uni Marburg):

  1. Sign in to the 2FA portal with your password and the code from a token that works.
  2. In the menu, go to Tokenausgabe and choose the token type App-Token.
  3. Scan the QR code with Novaz as above.
  4. Enter the new 8-digit code to verify it. The token works at once.

You can have up to ten tokens on one account (Uni Marburg).

If your token came by post

A QR code sent by letter or handed out at the service desk doesn't work until you activate it (Uni Marburg). Scan the letter's QR code with Novaz first. Then open the portal's activation page, accept the terms, and fill in Benutzername, Realm (shown in the letter's header) and Passwort + 2FA: your password with the 8-digit code typed straight after it. Click weiter.

Make backup TANs now

Each person can create up to two TAN lists of 12 codes in the 2FA portal. Since the HRZ's changeover, they only sign you in to the portal itself, not to Marvin, VPN or other services (Uni Marburg). That's enough to set up a new app token after losing your phone. Unless you've made a Novaz backup, its keys stay on your iPhone, so these lists are your way back in. Print them and keep them somewhere safe. More in 2FA backup codes.

Older TAN lists with more than 12 codes are expected to stop working in January 2027.

Entering the code

Web sign-ins through the university's Shibboleth login ask for the code on a second page. Services with only one field, such as some VPN clients, want the code added to the end of your password with no space (Uni Marburg).

If Marburg rejects your code

The HRZ accepts a code within a 180-second window, so a rejected code usually means your clock is off or you typed it wrong (Uni Marburg). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also check that the code has 8 digits. If it still fails, write to 2fa@hrz.uni-marburg.de with your account name and the topic. See Authenticator code not working?

Changing phones

The HRZ recommends signing in to the portal with the old phone or a backup TAN, setting up a new app token on the new phone, and deleting the old token only after the new one works (Uni Marburg). With Novaz, you can instead restore your accounts on the new iPhone from iCloud backup or a backup file, and the app token keeps working. Without a backup, follow the HRZ's route. See How to transfer your authenticator app to a new iPhone.

If you lose your phone

Block the lost token straight away (Uni Marburg):

  • With a backup TAN or second token: sign in to the 2FA portal, block the lost token and set up a new one.
  • Without one: report the token with the HRZ's status form or contact the IT service desk.

To get back in without any token, go to the IT service desk at Lahnberge or another on-site contact point, or use the VideoIdent process. After checking your identity, the HRZ gives you a registration token. It's valid for 60 minutes and only for the 2FA portal, where you set up a new app token (Uni Marburg). Emergency tokens are never sent by post, so sort out a backup before exam registration periods (Uni Marburg). More in Lost the phone with your authenticator app?

Deleting an old token

In the portal, deactivate the token first, then delete it. Support can only block tokens (Uni Marburg). Then tap Remove account on it in Novaz.

Official Philipps-Universität Marburg help

More guides: Universities and education