Registro.br 2FA: how to set up an authenticator app for your .br domains

Registro.br runs the .br domain registry. Its account, your user code and password, is where you manage domains, DNS servers, contacts and renewals. Its two-factor authentication (2FA) is called the Token. It's optional, and Registro.br recommends it. You can use an authenticator app on your phone (Token no aplicativo), a FIDO2/U2F security key (Token físico), or both, and you get a set of one-time recovery codes (Registro.br).

Without a Token, Registro.br emails a numeric "chave de acesso" (access key) when you sign in from a browser it doesn't recognize. It doesn't count that as a second factor, since your email can also reset your password, and recommends the Token instead (Registro.br). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Registro.br steps come from Registro.br's own help pages, linked below, which we read on October 21, 2026. The pages are in Portuguese and built with JavaScript, so we read their text in the public script file registro.br loads to show them, and checked it against a March 2024 archived copy on web.archive.org, which matches. We haven't tested the steps on a Registro.br account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on the Token with an authenticator app

Registro.br's help describes the start of the setup (Registro.br):

1. Sign in at registro.br with your user code and password.
2. Click Segurança (Security).
3. Click Cadastrar Token (register a Token). For a security key, the button is Cadastrar Novo Token Físico instead.
4. Follow the instructions on the screen, which the help doesn't list.

The help suggests Google Authenticator, but the Token is a standard time-based code that changes every 30 seconds (Registro.br), which is what Novaz makes. The help mentions a QR code for your account.

• To scan it, open Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
• The help doesn't say whether Registro.br also shows the key as text. If you see one, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?

Keep the 10 recovery codes

Registro.br gives you 10 one-time recovery codes (códigos de recuperação de acesso), also called Códigos de Segurança, and its help assumes you keep a printed list (Registro.br).

Keep them even if you back up Novaz: without an iCloud backup or a backup file, the keys exist only on your iPhone, and these codes are your way back in. Store them on paper or in a password manager. If you lose the list but still have the app, sign in with a code from Novaz and ask for a new batch. The old codes stop working when you do (Registro.br). More in 2FA backup codes.

What changes once it's on

• Signing in: you need your Token every time you sign in to manage domains or domain holders (Registro.br).
• Renewals: you can still pay a renewal without signing in, through Registro.br's problem-check tool.
• Forgotten password: this is the unusual part. To reset your password you then need a recovery code or your security key, plus access to the account's email. A code from the app doesn't count. That way a stolen phone holding both your email and your authenticator isn't enough to take over the account (Registro.br).

If Registro.br rejects your code

Registro.br says the phone's clock must be right, with up to 30 seconds of tolerance (Registro.br). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Moving to a new phone

Registro.br's help describes Alterar Token (change Token): once signed in, you click it and scan the new QR code (Registro.br). It covers only the lost-device case, so make the change while the old phone still works. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and keep the same Token. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use a recovery code or your security key to sign in, then click Alterar Token and scan the new QR code with the new phone (Registro.br).
2. No codes and no key: you need the administrative procedure Reabilitação de Conta de Usuário (user account rehabilitation), meant for accounts registered under a person's full name (Registro.br).
3. On the rehabilitation form, enter your user details, an identity document and an email address, then click Clique aqui para gerar a solicitação. Registro.br emails you the next steps.
4. Sign the request electronically with gov.br (a silver or gold gov.br account) and send it with the documents listed for your type of domain holder (Registro.br).

Registro.br says it reviews these requests within 2 business days of receiving the documents. Accounts under a shortened or company name use a different procedure, a transfer of the holder's contact. Questions go to doc@registro.br (Registro.br). More in Lost the phone with your authenticator app?

Turning the Token off

Sign in and click Remover Token for the app, or Remover este Dispositivo for a security key (Registro.br). In Novaz, open the Registro.br account and tap Remove account.

Official Registro.br help

• Gerenciamento de conta: Token
• Gerenciamento de conta: Chave de acesso
• Problemas para acessar a conta
• Procedimentos administrativos
• Reabilitação de conta de usuário
• Documentação aceita