PythonAnywhere 2FA: how to set up an authenticator app

PythonAnywhere hosts Python web apps, consoles and scheduled tasks in the cloud. Two-factor authentication (2FA) is optional there, and the only method PythonAnywhere describes is a code from an authenticator app on your phone. When it launched in 2016, PythonAnywhere said Google Authenticator or any other time-based (TOTP) app would work (PythonAnywhere).

One thing sets PythonAnywhere apart from most services: its support team can't turn 2FA off for you. Lose your phone and your emergency codes, and the account is gone for good.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the PythonAnywhere details come from PythonAnywhere's own help page, its official blog and replies from PythonAnywhere staff on its official forums, all linked below, which we read on October 21, 2026. The pages are short, some are years old, and none shows the setup screen. We haven't tested the steps on a PythonAnywhere account, so labels may differ. The Novaz steps are checked against the app, version 1.0.5.

Where the setting is

PythonAnywhere puts two-factor authentication on your Account page. Its 2016 announcement pointed users there (PythonAnywhere), and a staff member gave the same advice on the forums in 2020 (PythonAnywhere).

Use the site you signed up on: www.pythonanywhere.com or eu.pythonanywhere.com (PythonAnywhere).

Turn on 2FA with an authenticator app

PythonAnywhere's pages don't list the setup screen's buttons, so these steps stick to what they do say:

1. Sign in to PythonAnywhere and open your Account page.
2. Find the two-factor authentication section and start the setup.
3. If PythonAnywhere shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. If it shows a text key instead, tap +, then Enter key manually, type a name such as PythonAnywhere under Service, and paste the key into Setup key. See What is a 2FA setup key? PythonAnywhere's pages don't say whether a text key is offered.
5. Type the current code from Novaz to finish, if PythonAnywhere asks for one.
6. Save the emergency codes PythonAnywhere gives you (next section).

From then on, PythonAnywhere asks for a code from your phone after your username and password when you log in (PythonAnywhere).

A note on the code interval

PythonAnywhere's help page says the app makes a new number once a minute (PythonAnywhere). It gives no exact interval, and most apps use 30 seconds. Scan the QR code if you can, since it carries the timing settings. A key typed into Novaz by hand always gets 30-second codes. To see what Novaz is using, tap the account and check Interval under Details.

Save your emergency codes

When you set up 2FA, PythonAnywhere gives you a set of emergency codes. Each one works in place of a code from your phone (PythonAnywhere).

Once 2FA is on, you can't sign in without a code, and its support staff can't override that. Its help page says that without your phone or your emergency codes you're "locked out forever" (PythonAnywhere).

Without a Novaz backup, the keys exist only on your iPhone, and the emergency codes are what's left if it's lost. Keep them off that phone, on paper or in a password manager on another device. More in 2FA backup codes.

If PythonAnywhere rejects your code

PythonAnywhere's pages give no advice on rejected codes. Two things to check:

• The clock. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
• The interval. If you typed the key by hand and the codes never work, remove the account in Novaz (Remove account) and add it again by scanning the QR code, if PythonAnywhere still shows one.

More causes in Authenticator code not working?

SSH logins

In 2021, PythonAnywhere staff said that signing in over SSH didn't ask for a 2FA code, and that adding it was on their to-do list. Staff also offered to turn off SSH access on request (PythonAnywhere). We found no newer official word on this.

Changing phones

PythonAnywhere's pages don't describe moving 2FA to a new phone or turning it off. Since support can't reset it, make the switch while the old phone still works: check the two-factor section of your Account page, and erase the old phone only after PythonAnywhere accepts a code from the new one.

With a Novaz iCloud backup or backup file, you restore PythonAnywhere on the new iPhone and the codes keep working; without one, a new iPhone means adding it again. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your emergency codes, then set up 2FA again on your new phone.

Without the codes, PythonAnywhere's own pages offer no way back. In 2018, a user who had lost his phone and backup codes asked on the forums. A staff member replied that without some separate way to prove identity, they couldn't switch 2FA off (PythonAnywhere). PythonAnywhere's pages don't describe any such identity check.

See Lost the phone with your authenticator app?

Official PythonAnywhere help

• Securing your PythonAnywhere account
• Today's upgrade: improving websites, better security (blog, 2016)
• The PythonAnywhere newsletter, November 2016: Two-factor auth and a new system image (blog, 2016)
• Is pythonanywhere secure? (forum staff reply, 2020)
• Two Factor Authentication - Lost Phone (forum staff reply, 2018)
• 2FA on SSH? (forum staff replies, 2021)