Skip to content
Novaz AuthenticatorGET

Synology 2FA: how to set up an authenticator app for DSM

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Before you turn it on
  2. Turn on 2FA with an authenticator app
  3. When DSM asks for a code
  4. If DSM rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official Synology help

On a Synology NAS, two-factor authentication (2FA) protects a user account that lives on your own device, not in Synology's cloud. Each user of DiskStation Manager (DSM) turns it on for their own sign-in, and an administrator can make it mandatory for some or all users (Synology). The second step can be a push approval in Synology's Secure SignIn app, a hardware security key, or a 6-digit verification code (OTP). Synology recommends its own app for the codes, but says any authenticator that supports TOTP works (Synology). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Synology steps come from the Synology Knowledge Center, linked below, which we read on October 20, 2026. Its main 2FA help page covers DSM 7.4. We haven't tested the steps on a Synology NAS, so a label may differ slightly, especially on older DSM versions. The Novaz steps are checked against the app, version 1.0.5.

This guide covers DSM sign-in only. Your Synology Account at account.synology.com, used for QuickConnect, DDNS and cloud services, is separate (Synology). It has its own 2FA under Security > Sign-in Options > More > Multi-factor sign-in (Synology), and unlike DSM it offers 10 recovery codes (Synology).

Before you turn it on

  • Codes work everywhere. Approve sign-in and security keys only work in a web browser, so Synology says you need OTP for its mobile apps and desktop utilities (Synology). Novaz makes codes only, so OTP is the one to pick.
  • Add an email address you can reach. DSM has no backup codes. Its fallback is a code sent to a verified address, set at Personal > Account.
  • Some things stop working. Virtual Machine Manager and Synology Presto Automator don't support 2FA, and Synology suggests a separate account without it for them (Synology). Hyper Backup and Shared Folder Sync jobs that use rsync with SSH transfer encryption also stop working normally (Synology).

Turn on 2FA with an authenticator app

From Synology's DSM and Secure SignIn help (Synology, Synology):

  1. In DSM, click the user icon at the top right of the desktop, go to Personal > Security, and click 2-Factor Authentication. An older Synology tutorial puts it under Personal > Account (Synology).
  2. Select Verification code (OTP), enter your password, and click Start in the wizard.
  3. The first QR code downloads Synology Secure SignIn. It isn't for Novaz, so click Next.
  4. The next QR code is your account. In Novaz, tap +, then Scan QR code, and point the camera at it. If DSM is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  5. If you can't scan it, click Can't scan it to see a secret key. In Novaz, tap +, then Enter key manually, name it in Service, and paste the key into Setup key. Synology doesn't say how often its codes change, so scan the QR code when you can. See What is a 2FA setup key?
  6. Type the 6-digit code from Novaz into the wizard and click Next.
  7. Confirm Backup e-mail settings. Click Send verification email, open the link in the message, then go back to DSM.
  8. Click Done (the Secure SignIn help says Close). The Second sign-in step should now show Verification code (OTP).

When DSM asks for a code

After your password, DSM asks for your default second step. If that isn't the code, click Try another sign-in method. To skip the code on a computer you trust, go to Manage Trusted Devices > Manage in your 2FA settings and click Remember this device. The trust covers one account in one browser, so a different browser or cleared cookies bring the code back (Synology). Revoke Other Devices forgets every other remembered device.

If DSM rejects your code

Synology points to two clocks, your phone's and the NAS's, which have to agree (Synology).

  • iPhone: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
  • NAS: an administrator goes to Control Panel > Regional Options > Time, selects Synchronize with NTP server, picks a server, and clicks Update Now.

Synology warns that changing NTP settings while 2FA is on can break codes, so the administrator should turn off their own 2FA first. More causes are in Authenticator code not working?

Changing phones

Synology's DSM help doesn't describe moving an OTP setup to a new phone. In Novaz, iCloud backup or a backup file lets you restore your accounts on the new iPhone with the same codes. Without one, check that your backup email works before you give up the old iPhone. If your NAS has another administrator, they can reset your 2FA (below) so you can set it up again on the new phone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Try these in order (Synology):

  1. Another method. If you also set up Approve sign-in or a security key, choose it with Try another sign-in method.
  2. Backup email. On the sign-in page, click Lost your mobile device? and DSM emails a code to your verified address (Synology).
  3. Another administrator. They open Control Panel > User & Group, select your user, click Edit, and on the Info tab click Disable 2-factor Authentication (Synology).
  4. You're the only administrator. Synology's answer is a Mode 1 reset: hold the RESET button on the NAS for about 4 seconds until it beeps. Your stored data stays, but besides turning off 2FA for the admin account, it resets network settings to DHCP and switches off Auto Block and firewall rules (Synology). Read the full instructions first.

Synology's pages don't involve its support team: every fix happens on the NAS. More in Lost the phone with your authenticator app?

Turning 2FA off

Go to Personal > Security > 2-Factor Authentication, enter your password, and click Turn Off. Synology keeps your configured devices for the next time you turn it on (Synology).

Official Synology help

More guides: Cloud storage and backup