POST Luxembourg 2FA: how to set up an authenticator app for webmail
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
This guide is for POST Luxembourg's residential email, the @pt.lu and @mylife.lu addresses you read at webmail.pt.lu (POST). Two-factor authentication (2FA) is optional. POST offers it two ways: a code by text message, or a code from an authenticator app, which POST's screens call OTP (smartphone application). You can use one or both (POST). We use Authenticator App - Novaz on iPhone below, but any authenticator app works the same way.
How we checked this guide: the POST Luxembourg steps come from POST's own help pages, linked below, which we read on October 21, 2026. We haven't tested them on a POST account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
POST's 2FA article was last updated in January 2024, but its screenshots date from 2020 and show an older webmail design. If your screen looks different, look for the same names in the settings menu.
Before you start: add a mobile number
POST asks you to save a mobile number under Password recovery in the settings menu before you turn on 2FA (POST). The settings screen itself says the number is what makes the SMS option work. POST's password recovery page adds that only Luxembourg, French, German and Belgian numbers are accepted, and that you confirm the number with a code sent by text (POST).
Turn on 2FA with an authenticator app
From POST's help article and its screenshots (POST):
- Sign in at webmail.pt.lu and open SETTINGS.
- In the left menu, under Account security, select Two-factor authentication.
- Select Activate 2FA.
- In the Two-factor authentication activation window, choose OTP (smartphone application). (SMS sets up text-message codes instead.)
- POST shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, POST prints the key under the QR code. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
- Select Continue and finish the remaining steps POST shows.
POST's help calls that key the "secret" and asks you not to share it. The key in its screenshot ends with equals signs, which are padding. POST doesn't say how often its codes change, so scanning the QR code is the safer choice.
Once 2FA is on, the same settings page shows a device list with Device name, Device, Country, Method and Last login, and buttons for OTP, Reset OTP, Modify and Delete.
Signing in afterwards
On a device POST doesn't know yet, a Two-factor authentication screen asks you to pick SMS or OTP (smartphone application). Choose the second, type the code from Novaz in Code, and select Continue.
Next you can name the device and tick Do not ask again on this device. POST says this screen appears only during sign-in, and that a trusted device isn't asked for a code at every login (POST). Only tick it on your own computer.
No backup codes
POST's help doesn't mention backup or recovery codes. Your fallback is the SMS method, if you set it up as well, and the helpdesk. With the app alone and no Novaz backup, a lost phone means calling POST.
If POST rejects your code
POST's help doesn't cover rejected app codes. Check that you chose OTP (smartphone application) and not SMS at sign-in. Then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
If you lose your phone
POST's advice depends on whether you can still get into webmail (POST):
- You can still sign in (on a trusted computer, or with an SMS code): remove the lost phone from the device list, then select Reset OTP and confirm with Reset. The confirmation warns that this removes every device registered for app codes, and that it's meant for a lost phone or a stolen secret.
- You're locked out: call POST's helpdesk on 8002 8004, or +352 2424 8004 from abroad. POST's support page says the 8002 number is free to call and the line is open 24/7 (POST). POST doesn't say what proof it asks for or how long it takes.
See also Lost the phone with your authenticator app?
Changing phones
POST doesn't describe moving the authenticator to a new phone, but restoring Novaz from iCloud backup or a backup file brings your accounts over with it. Reset OTP is the only documented way to drop the old setup, and POST's help doesn't describe adding an app again after it. Keep SMS working and the old phone in hand until the new one works. See How to transfer your authenticator app to a new iPhone.
Turning 2FA off
POST's article gives no separate steps for switching 2FA off, and it states plainly: "we do not recommend disabling the 2FA" (POST). To stop a computer from skipping the code, select it in the device list and remove it. It will ask for a code again at the next sign-in.
