Posteo 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Posteo account holds your email, address book, calendar and notes. Its two-factor authentication (2FA) is optional and works with any app that makes standard time-based (TOTP) codes, or with a YubiKey (Posteo). Two things set it apart. It protects signing in to Posteo in the browser, not the email programs on your devices. And Posteo gives you no backup codes: the secret key itself is your only spare. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Posteo steps come from Posteo's own help pages, linked below, which we read on October 21, 2026. posteo.de refused our automated requests, so we read the pages in archived copies on web.archive.org, the newest saved on September 20, 2026. We haven't tested the steps on a Posteo account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
What 2FA covers at Posteo
Once 2FA is on, signing in to the webmail or the Posteo web app asks for your password and then a six-digit one-time password from your app. With only your password, nobody can change your settings or lock you out (Posteo).
Mail programs that connect over IMAP, POP3 or SMTP don't ask for a code. Posteo's answer is a separate setting, Additional email account protection for webmail users, which shuts those programs out completely, so your mail can only be read in the browser or the web app (Posteo).
Turn on 2FA with an authenticator app
Sign in to the Posteo webmail in a browser, then follow these steps (Posteo):
- Click Settings, then My account, then Password and security.
- Under two-factor authentication, enter your Posteo password.
- Tick the box that confirms you've installed a one-time password app.
- Click Activate two-factor authentication.
- Posteo shows a QR code with the key written above it. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot, then tap + and Choose a photo. See scanning a QR code on the same iPhone.
- To type the key instead, tap +, then Enter key manually. Enter "Posteo" as the Service and the characters above the QR code as the Setup key. Posteo's codes are six digits, every 30 seconds, with SHA1, which matches what Novaz uses for a typed key. See What is a 2FA setup key?
- Enter the current code from Novaz to check the transfer.
- Click Confirm activation.
Two older Posteo pages call the settings page Change password instead, so the label may differ on your screen.
Save the secret key, because there are no backup codes
Posteo's help doesn't mention backup or recovery codes. Instead it suggests two ways to avoid being locked out: add the key to a second device, and copy the secret key and store it somewhere safe (Posteo).
A Novaz backup keeps a copy too, but it's worth having one outside the app: while setting up, copy the key shown above the QR code into a password manager or onto paper you keep away from your phone. Anyone with that key can make your codes, so guard it like a password.
You can also see the key again later. Go to Settings > My account > Password and security. In the two-factor authentication section, under Add another device, enter a current code and your Posteo password, then click Show secret key. Posteo shows the same QR code and key, which you can add to a second device (Posteo).
If Posteo rejects your code
Posteo's help doesn't cover rejected codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If you typed the key by hand, check it against Posteo's screen for a missed or swapped character. More causes are in Authenticator code not working?
Moving to a new iPhone
With a Novaz iCloud backup or backup file, you restore Posteo on the new iPhone along with your other accounts. Even without one, you don't need to start over: while you can still sign in, use Add another device and Show secret key as described above, and scan the QR code with Novaz on the new iPhone. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
If you have a Novaz backup, restore it on the new iPhone. If you saved the secret key, add it to Novaz on another iPhone with Enter key manually, and you're back in.
Without the key or a second device, Posteo says plainly that losing the device or deleting the app means losing access to your account. Its only route is support: email support@posteo.de or use the contact form (Posteo). Posteo doesn't say what proof it asks for or how long it takes. So treat the saved key as your real recovery plan. See Lost the phone with your authenticator app?
Turning 2FA off
In the webmail, click Settings, then My account, then the password and security page. Under Two-factor authentication, enter a current code and your Posteo password, then click Deactivate two-factor authentication. The old secret key stops working on every device, and you can delete it from Novaz with Remove account (Posteo).
