Skip to content
Novaz AuthenticatorGET

RuneScape 2FA: how to set up an authenticator app on your Jagex account

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Which login do you have?
  2. Add an authenticator app to a Jagex account
  3. Your 10 backup codes
  4. Legacy RuneScape logins
  5. If RuneScape rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Official RuneScape help

RuneScape and Old School RuneScape have two kinds of login. A Jagex account holds up to 50 characters under one email address and is what the Jagex Launcher and mobile apps use. An older RuneScape account, here called a legacy login, signs in to one character through the game clients (Jagex). Both can use an authenticator app, but the setting lives in a different place for each.

A Jagex account always has two-step authentication on. By default the security code comes by email at every login, and an authenticator app is an optional extra (Jagex). Jagex says an app protects you even if someone has your password or your email (Jagex). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the RuneScape steps come from Jagex's own help pages on support.runescape.com, linked below, which we read on October 19, 2026. We haven't tested them on a Jagex or RuneScape account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Which login do you have?

Enter your email address on Jagex's login page. If it asks for your password there, you have a Jagex account. If it sends you to a RuneScape screen, you have a legacy login. Upgrading is optional for now, but Jagex plans to make it mandatory (Jagex). The upgrade includes setting up two-step authentication and can't be undone (Jagex).

Add an authenticator app to a Jagex account

  1. Log in to your Jagex account management at account.jagex.com.
  2. Under Two-step authentication, switch on Security codes via authenticator app.
  3. Follow the prompts, then save your backup codes somewhere safe (Jagex).

Jagex's help doesn't show the next screens, say whether you can type a key, or give the code length and interval. So scan the QR code: in Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo (scanning a QR code on the same iPhone). If you're asked for a code to confirm, type the one Novaz shows. A key typed in with Enter key manually always gets 6-digit codes every 30 seconds (What is a 2FA setup key?).

Email codes stay on

The app doesn't replace Security codes via email. You can switch email codes off, but one of the two must stay on (Jagex). Jagex's screenshot of the login step, Choose a way to verify it's you, shows Use your authenticator app, Send a code to your email address and Use one of your account's backup codes. Leaving email on gives you a way back in if you lose your phone. But Jagex warns that anyone who gets into your email can read those codes (Jagex).

Your 10 backup codes

You get 10 backup codes when you add the authenticator, and Jagex asks you to store them away from the phone that holds the app (Jagex). Each works once and skips the code step completely, so guard them like a password. They still work if you turn the authenticator off later (Jagex).

For a fresh set, find Backup Codes under Two-step authentication, select the three dots, then Replace. The old set stops working. Lost track of them? Jagex suggests searching your devices for "Jagex - Backup Codes.txt" (Jagex).

Jagex's advice for a lost phone is an authenticator app that syncs to the cloud. In Novaz, that's iCloud backup (PRO) in Settings › Backup, and an exported backup file works too. Without either, the backup codes are your way back in. See 2FA backup codes.

Legacy RuneScape logins

Without the upgrade, the authenticator has its own settings page at secure.runescape.com (Jagex):

  1. Log in to the authenticator account settings and select Enable Authenticator.
  2. Scan the QR code with Novaz. If it won't scan, select Can't scan the code? for a key to type.
  3. Enter the 6-digit code from Novaz.

The login screen has a checkbox to remember a device for 30 days (Jagex). The legacy pages don't mention backup codes: your registered email is the fallback, so anyone who gets into it could remove the authenticator (Jagex).

If RuneScape rejects your code

Jagex's one tip, written for legacy logins, is to make sure your phone and computer show the same time and time zone (Jagex). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your RuneScape codes come with it. Without one, you'll set RuneScape up again on the new one. Jagex's help covers new phones only through cloud-sync apps or a backup code (Jagex). On a Jagex account, check that Security codes via email is on, then switch the app off and on again with the new phone. On a legacy login, turn the authenticator off in its settings and enable it again (Jagex). Do either while you still have the old phone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Jagex account: at login, choose Send a code to your email address if email codes are on, or use a backup code, then set up a new method. If backup codes were your only way in and they're gone, contact Jagex's support team. Jagex doesn't say what proof it asks for or how long it takes (Jagex). Jagex also can't change or reveal the email address on a Jagex account, so keep that inbox safe (Jagex).

Legacy login: log in on the authenticator removal page, which doesn't ask for a code, select Lost your authenticator? and follow the email sent to your registered address. It can take about 15 minutes, and a new request cancels the last one (Jagex). No access to that email? First submit a recovery appeal with every detail you remember, so Jagex can confirm you created the account. The answer should come by email within 24 hours (Jagex).

More in Lost the phone with your authenticator app?

Official RuneScape help

More guides: Gaming and betting