Skip to content
Novaz AuthenticatorGET

Surfshark 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Read this first: no codes, no account
  2. Turn on 2FA with an authenticator app
  3. Sharing the account with family
  4. When Surfshark asks for a code
  5. If Surfshark rejects your code
  6. New iPhone
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official Surfshark help

Most people know Surfshark for its VPN, but one Surfshark account also runs Alert, Antivirus and the rest of the Surfshark One tools. Two-factor authentication (2FA) is optional for the account itself. Alert is the exception: until 2FA is on, it won't show you sensitive results such as leaked passwords (Surfshark, Surfshark).

There are two methods: an authentication app, which Surfshark recommends, and email codes, which it calls less secure (Surfshark). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Surfshark steps come from Surfshark's own help center, linked below, including the screenshots in its articles, which we read on October 20, 2026. We haven't tested them on a Surfshark account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Read this first: no codes, no account

At the end of setup, Surfshark lists 10 one-time recovery codes and says it will show them only once. The same screen, pictured in Surfshark's recovery code article, warns that if you lose your authenticator and these codes too, "you will not be able to recover your Surfshark account" (Surfshark).

Save them even if you back up Novaz: without iCloud backup or a backup file, its keys exist only on your iPhone, and an older backup may not include Surfshark. Surfshark suggests a photo, a password manager or cloud storage: somewhere you'll still have if the phone is gone. More in 2FA backup codes.

Turn on 2FA with an authenticator app

Surfshark's setup article and its screenshots show this flow on the website (Surfshark):

  1. Log in on the Surfshark login page.
  2. Open My account in the top-right corner and choose Account settings.
  3. On the Login & security tab, find Two-factor authentication (it reads Off) and select Edit.
  4. Under Select a security method, choose Authentication app.
  5. The Set up an authentication app screen shows a QR code. In Novaz, tap +, then Scan QR code, and aim the camera at it. If the page is open on the same iPhone, take a screenshot, then tap + and Choose a photo. See scanning a QR code on the same iPhone.
  6. Select Next, enter the 6-digit code Novaz now shows for Surfshark, and select Next again.
  7. On Two-factor authentication is now on, select Download recovery codes. Your browser saves them as recovery.txt. Select Done once the file is saved.

Surfshark then signs you out on all your devices, so you'll sign in again with a code. In step 3, Surfshark's Alert article shows Turn on instead of Edit, so your label may differ.

Why to scan rather than type the key

Beside the QR code, Surfshark shows a text key under Or enter this code into your authentication app. But its help says app codes reset every 60 seconds (Surfshark), and a key typed into Novaz with Enter key manually always gets 30 seconds. A QR code carries its own timing, so scan it, even from a screenshot. You can check the result under Details > Interval in Novaz.

Sharing the account with family

If several people share one Surfshark account, every phone scans the same QR code during setup (Surfshark). If 2FA is already on, Surfshark's article has you turn it off (Edit, Turn off 2FA, Yes, I'm sure) and set it up again with everyone present. Each person can scan with Novaz on their own iPhone.

When Surfshark asks for a code

The setup article says you'll need a code after your password the next time you log in. The method screen puts it more narrowly: the first time you sign in on a new device. Either way, the website and the Surfshark apps both ask on a screen called Enter an authentication code, then Verify (Surfshark).

If Surfshark rejects your code

Surfshark's 2FA articles don't cover a rejected app code. Start with the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is off by 15 seconds or more.

A Too many login attempts error means a temporary block on your IP address, usually for 10 minutes; wait, or change network or VPN server (Surfshark). More causes in Authenticator code not working?

New iPhone

Surfshark's help doesn't describe changing phones. While you still have the old one, you can turn 2FA off (below) and set it up again with the new phone. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same Surfshark codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a recovery code (Surfshark):

  1. Log in with your email and password.
  2. On the code screen, choose Enter a recovery code. A newer screenshot shows Use a recovery code.
  3. Type one code and select Verify. Each code works once.
  4. Go to Account settings and set up 2FA again with your new phone.

Afterwards, Edit also offers Regenerate recovery codes, with a count of used codes.

Without the codes, Surfshark's help describes no way back. Support answers by live chat and email around the clock (Surfshark), but no 2FA article says it can remove 2FA. See Lost the phone with your authenticator app?

Turning 2FA off

In Account settings, select Edit next to Two-factor authentication, then Turn off two-factor authentication (the article text says Turn off 2FA), and confirm with Yes, I'm sure. The dialog warns that Alert stops working without 2FA, and you'll be logged out (Surfshark). Then open Surfshark in Novaz and tap Remove account.

Official Surfshark help

More guides: Security, identity and VPN