Skip to content
Novaz AuthenticatorGET

RoboForm 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Keep this code out of RoboForm
  2. Turn on 2FA with an authenticator app
  3. When RoboForm asks for the code
  4. No backup codes, but an email fallback
  5. If RoboForm rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official RoboForm help

Your RoboForm account holds the logins for everything else, and it already has a second step: new accounts start with one-time passwords sent by email, and you can add text messages, an authenticator app, or a passkey on a phone or hardware key (RoboForm, RoboForm). RoboForm's help now says two-factor authentication is available on every RoboForm account. An archived copy of the same page from February 2026 limited it to Premium (RoboForm). This guide adds an authenticator app with Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the RoboForm steps come from RoboForm's own help center, linked below, which we read on October 21, 2026. The help center pages block automated access, so we read the articles through the help center's public article feed on help.roboform.com, and compared the main article with an archived copy on web.archive.org from February 10, 2026. We haven't tested them on a RoboForm account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Keep this code out of RoboForm

RoboForm has its own built-in authenticator for your other accounts, and it syncs those codes to every device where you sign in (RoboForm). Its authenticator article doesn't say whether RoboForm's own code may live there. Its passkey article warns that storing your second factor in RoboForm puts both factors in one place, leaving email as the fallback if you're locked out (RoboForm). A code you can only read after signing in to RoboForm can't get you into RoboForm on a new device, so keep it in a separate app.

Turn on 2FA with an authenticator app

RoboForm's help describes these steps in the browser extension (RoboForm):

  1. Click the RoboForm extension icon in your browser, click the three dots at the top right, and choose Settings.
  2. In the left column, choose Log In & Security, then Two-Factor Authentication.
  3. Click Add 2FA Method at the lower left.
  4. Choose Authenticator App. RoboForm shows a QR code and a secret key.
  5. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. Type the six-digit code from Novaz in the field labeled Enter OTP from Google Authenticator App. The label names Google's app, but codes from Novaz work the same way.

Scan the QR code if you can. RoboForm's help says the codes have six digits, but not how often they change or how long the secret key is. A QR code passes those settings to Novaz. A key typed in with Enter key manually always makes 30-second codes and has to be at least 16 characters. See What is a 2FA setup key?

An older RoboForm page reaches these settings from the RoboForm Start Page, through Settings and a Security tab, so labels may differ depending on where you start (RoboForm).

When RoboForm asks for the code

RoboForm asks for the code the first time you sign in on a new device. After that, the device stays authorized until it's removed from your account. If you enroll a browser, RoboForm keeps that status in a cookie, so clearing cookies means another code (RoboForm).

With RoboForm for Business, your company's admin sets the rules. Policies can ask for a code on every sign-in, end enrollment after a set number of days or minutes, or switch off authenticator apps as a method (RoboForm).

No backup codes, but an email fallback

RoboForm's pages don't mention backup or recovery codes. The documented fallback is email: on the code prompt, choose Send OTP by Email, and RoboForm sends a one-time password to your account's email address (RoboForm). If your iPhone is gone and you have no Novaz backup, that email inbox is your way back in. Protect it with its own two-factor authentication.

If RoboForm rejects your code

RoboForm's help doesn't cover rejected authenticator codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

RoboForm's help doesn't describe moving the authenticator to a new phone. Its settings give you the tools: while you can still sign in, remove the old authenticator and choose Add 2FA Method again with the new phone. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and keep your current setup. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

  1. At the code prompt, choose Send OTP by Email and sign in with the emailed code.
  2. If the lost phone also had RoboForm on it, go to Settings > Devices & Activity, click the three dots next to the device, and choose Remove this device (RoboForm).
  3. Remove the old authenticator and add it again on your new phone.

If you can't reach the email, phone number or authenticator app on your account, RoboForm says to submit a support ticket through its contact form. It doesn't say what proof it asks for or how long this takes.

Your Master Password is a separate problem. If you forget it, RoboForm's Account Recovery option can reset it, but only on a device that was already enrolled with two-factor authentication and is still signed in. Without that, a reset erases your RoboForm data (RoboForm). More in Lost the phone with your authenticator app?

Turning 2FA off

Go back to Settings > Log In & Security > Two-Factor Authentication and click the trash can to the right of Authenticator App (RoboForm). In Novaz, open the RoboForm account and tap Remove account afterwards, not before.

Official RoboForm help

More guides: Security, identity and VPN