Proton 2FA: how to set up an authenticator app for your Proton Account

Proton Mail, Proton Pass, Proton VPN and Proton Drive have no logins of their own. They all run on one Proton Account, and its settings apply to every Proton app (Proton). So you turn on two-factor authentication (2FA) once, and every Proton app then asks for a code each time you sign in (Proton). Proton's pages don't mention remembering trusted devices.

2FA is optional on free and paid plans. You can use an authenticator app, a U2F or FIDO2 security key, or both (Proton). In a Proton for Business organization, an administrator can require it. If they do, your account is restricted until you set it up (Proton). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Proton steps come from Proton's own help pages and their screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a Proton account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Keep this code out of Proton Pass

Proton Pass can make 2FA codes for your other logins, but not for this one. Proton's Pass help says "you should never use Proton Pass to secure your Proton Account using TOTP" and points you to a separate authenticator app (Proton). Pass opens with the same account, so a code kept there is locked away just when you need it. Proton says the same about your recovery phrase: not in Pass, not in Drive (Proton). A Proton VPN page does mention Pass for codes; the Pass page is the one that covers this case.

Turn on 2FA with an authenticator app

Proton's authenticator app article gives these steps (Proton):

1. Sign in at account.proton.me and open Settings (the gear), then All settings.
2. Select Account and password. Under Two-factor authentication, turn on the Authenticator app toggle.
3. Enter your password.
4. Proton shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, click Enter key manually instead. Proton shows a Key, an Interval of 30 and 6 Digits, which match what Novaz uses for a typed key. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
6. Click Next, enter your password and the 6-digit code from Novaz, and click Submit.
7. Save your recovery codes (below).

Proton VPN users can do the same at account.protonvpn.com, under Account > Two-factor authentication (Proton).

Want a second device? Scan the same QR code with it now. Adding one later means turning the toggle off and on and pairing every device again (Proton).

Save your recovery codes

The last setup screen lists single-use recovery codes, 16 in Proton's screenshot, with a Download button and a warning that losing your 2FA device without them can cost you the account (Proton). Each code stands in for one 6-digit code (Proton). Without a Novaz backup, these codes are your way in if the phone is lost. Keep them somewhere you can reach without signing in to Proton, such as on paper. Proton's pages don't describe getting a fresh set. See 2FA backup codes.

If Proton rejects your code

Proton links the Incorrect login credentials error to clocks: the device making codes and the one you sign in on should show the same time (Proton). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Moving to a new iPhone

Proton's pages describe no transfer step. Turn the Authenticator app toggle off, turn it back on, and scan the new QR code with the new phone (Proton). Codes from the old setup stop working (Proton). Do it before you give up the old phone. With Novaz, you can skip this by restoring from iCloud backup or a backup file on the new iPhone; without one, this is the way. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Proton lists these ways back in (Proton):

• Another 2FA device, such as a second paired authenticator or a security key.
• A recovery code, through Use recovery code on the code screen, as Proton's newest screenshot shows (Proton).
• Still signed in somewhere: in Account and password, click Lost access to your 2FA device?, then Continue, and verify with your recovery phrase or a code sent to your recovery email or phone. This turns 2FA off without touching your password or data. If you're signed in only in a phone or desktop app, move the session to the web with QR code sign-in.
• Signed out: after your password, choose I don't have my 2FA device, then I don't have my back-up code, to request a recovery code through your saved recovery method. A newer screenshot shows Don't have access to your 2FA? instead, so labels may differ.

The last two need a recovery method set up beforehand (Proton). Proton doesn't describe another route or say how long it takes. Once you're back in, set up 2FA again with your new phone. See Lost the phone with your authenticator app?

Turning 2FA off

In Account and password, turn off the Authenticator app toggle and enter your password (Proton).

Official Proton help

• Two-factor authentication (2FA)
• Set up two-factor authentication (2FA) with an authenticator app
• How to use 2FA in Proton Pass
• Two-factor authentication on Proton VPN
• How to open your Proton Account settings
• Proton Account recovery explained
• Recovery phrase
• QR code sign-in
• Enforcing two-factor authentication (2FA) for organizations