Runbox 2FA: how to set up an authenticator app

Runbox is an email service with webmail, calendar, contacts and file storage under one account. Two-factor authentication (2FA) is optional, though Runbox strongly recommends it (Runbox). It offers two kinds of second step: timed codes from an authenticator app, and a list of one-time codes you can print. This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Runbox steps come from Runbox's own help pages, including the screenshots on them, linked below, which we read on October 21, 2026. We haven't tested them on a Runbox account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: your mail apps will stop signing in

Once 2FA is on, your normal Runbox password stops working for IMAP, POP, SMTP, FTP, CalDAV and CardDAV. Any mail, calendar or contacts program on your phone or computer needs an App Password instead (Runbox). Webmail keeps using your normal password plus a code.

Create them under Security > App Passwords. Runbox shows each one only once, and they don't work for webmail (Runbox).

Turn on 2FA with an authenticator app

The newest Runbox help page shows the setup in the current webmail, called Runbox 7 (Runbox):

1. Sign in to webmail at runbox.com and open the settings (the gear icon).
2. In the Settings Menu, open Security, then Two-Factor Authentication.
3. Under Timed One-Time Passwords, select Generate Key. A key appears in the Key field, along with a Label that identifies the account in your app.
4. Runbox shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. If you'd rather type it, copy the key from the Key field. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. Runbox codes have 6 digits and change every 30 seconds, which matches what Novaz uses for a typed key. See What is a 2FA setup key?
6. Type the code from Novaz into Runbox and select Check Code to confirm the setup works.
7. The setup screen says 2FA turns on once you finish. Check that the Two-Factor Authentication switch at the top shows Enabled; an older Runbox page has you flip it yourself.

Runbox won't show the key again once it's active. If you want the same key on a second device, copy it before you finish, then delete the copy (Runbox).

Make an unlock code and one-time codes

Runbox doesn't have backup codes in the usual sense. It has two related tools on the same page (Runbox):

• Unlock Code: select Generate Code under Unlock Code. This code turns 2FA off if you lose your authenticator. Runbox recommends creating one when you enable 2FA.
• One-Time Passwords: select Generate Codes for a list of 40 single-use codes, 16 characters each. Each one works once, together with your username and password. Making a new list cancels the old one.

If your phone is gone and you have no Novaz backup, the unlock code is your way back in. Keep it off the phone, in a password manager or on paper. See 2FA backup codes.

When Runbox asks for a code

Webmail asks for a code at sign-in, in addition to your username and password. On the same page you can mark a browser as trusted under Trusted Browsers (Trust this Browser), and that browser then signs in with just your password. Runbox says to do this only on devices nobody else uses (Runbox). Mail programs never ask for a code; they use app passwords.

If Runbox rejects your code

Runbox's troubleshooting page names two causes: a code for a different account, and a wrong date or time on the device (Runbox). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If the codes still fail, Runbox says to use your unlock code. More causes are in Authenticator code not working?

Changing phones

Runbox's help doesn't describe moving 2FA to a new phone. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and keep the same codes. Without one, you'll set Runbox up again on the new one. Keep the old phone until Runbox accepts codes from the new one. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use your unlock code. It signs you in and turns 2FA off; you can then set it up again on the Two-Factor Authentication page (Runbox).
2. If you made a list of one-time codes, one of those also gets you past the code step.
3. Without either, contact Runbox Support (Runbox). Its support guide says to email mail@support.runbox.com from your Runbox address or from the alternative email address on your account. From any other address, Runbox must first verify you own the account, which takes longer (Runbox). Runbox doesn't say how long recovery takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Use the Two-Factor Authentication switch at the top of the same page. Runbox lets you switch 2FA off and on again without generating a new key (Runbox).

Official Runbox help

• Runbox 7 Security
• Account Security
• More About Two-Factor Authentication and App Passwords
• Problem Solving
• Usernames and Passwords
• Runbox Support Guide