Private Internet Access 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Private Internet Access (PIA) is a VPN service. Your PIA account, managed in the Client Control Panel on the PIA website, holds your subscription, billing and downloads. Two-factor authentication (2FA) is optional, and PIA offers it in one form only: codes from an authenticator app on a phone or tablet. There's no text-message option in PIA's help (PIA). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the PIA steps come from PIA's own help center, including the screenshots in its articles, which we read on October 21, 2026. We haven't tested them on a PIA account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
The setting sits in the Client Control Panel, not in the VPN app. PIA's help article, last updated in July 2026, describes these steps (PIA):
- Sign in to the Client Control Panel from PIA's sign-in page. Your username looks like p1234567 (PIA).
- Select Account Settings in the left-hand menu.
- Under Login and security, find Two-factor authentication, which shows Disabled, and select Enable.
- Type your current password and select Enable Two Factor Authentication.
- A box titled Confirm Two Factor Authentication shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
- Type the code from Novaz in the Enter two-factor code box and select Confirm Two Factor Authentication.
- PIA now shows your recovery codes. Save them, then select I have safely stored the codes. PIA also emails you to say 2FA is on.
Two things to know about the QR code
PIA's help suggests switching your browser away from a dark theme before this step, because some cameras can't read the QR code on a dark page.
PIA's article and its screenshot of this screen show only the QR code. They don't show a text key you could type instead. So if the Control Panel is open on the same iPhone that runs Novaz, take a screenshot of the QR code, then in Novaz tap +, then Choose a photo. See scanning a QR code on the same iPhone. Delete the screenshot once the account is added.
Your recovery codes
The confirmation screen says the codes are for one-time use, that they won't be shown again, and that you need one to sign in if you lose your 2FA device. The disable form also accepts an "unused recovery code", which tells you each one works only once (PIA).
PIA's help doesn't say how many codes you get, and doesn't describe a way to create a new set later. Treat the first set as the only one. If the phone is lost and you have no Novaz backup, these codes get you in. Store them in a password manager or on paper, away from the phone. More in 2FA backup codes.
When PIA asks for a code
PIA's help says 2FA protects your PIA account and that you'll need a recovery code to sign in without your device. It doesn't say whether the PIA VPN apps on your computer or phone also ask for a code, or only the Client Control Panel does. It also doesn't describe trusted devices.
If PIA rejects your code
PIA's help has no advice on rejected codes. The usual cause is a phone clock that's off by a little. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when your clock is 15 seconds or more off. Other causes are covered in Authenticator code not working?
Changing phones
PIA doesn't describe moving 2FA to a new phone. The documented route is to turn 2FA off on the old phone (below), then turn it on again with the new one, which gives you a new QR code and new recovery codes. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead: see How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with one of your recovery codes. Then turn 2FA off and set it up again on your new phone.
If you have no recovery codes left, PIA's 2FA article only says to contact support if you have problems with 2FA, through its request form (PIA). It doesn't say whether support can remove 2FA or how long that takes. PIA's general rule is that support must confirm the account is yours before helping. The simplest proof is writing from the email address on the account. Otherwise you can give your order number or payment details that match how you paid (PIA). More in Lost the phone with your authenticator app?
Turning 2FA off
In the Client Control Panel, open Account Settings, find Two-factor authentication and select Disable. Enter your password and a code from Novaz or an unused recovery code, then select Disable Two Factor Authentication (PIA). PIA then reminds you to delete the old entry from your authenticator app: in Novaz, open the account and tap Remove account.
