Termius 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Termius is an SSH client, and its account syncs your hosts, keys and snippets between devices in an encrypted vault. Before you add an authenticator app to that account, know one thing: Termius's documentation describes no backup codes. If you lose the authenticator, the documented way back in is a reset that leaves your previously synced data unreadable (Termius). So plan your recovery before you turn 2FA on.
Termius offers two second factors: a time-based code from any authenticator app (TOTP), or Authy with a phone number. This guide uses the authenticator app route, with Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Termius steps come from Termius's own documentation at docs.termius.com, linked below, which we read on October 21, 2026. We haven't tested them on a Termius account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Which sign-ins it protects
Termius only asks for the second factor when you sign in with your email address and encryption password. If you sign in with Apple, Google or SAML SSO, Termius doesn't ask for a code at all (Termius). After an SSO sign-in, Termius still asks for your encryption password to open the vaults (Termius).
On Team, Business and Enterprise plans, the team owner can turn on Require 2FA for all team members on the Team page of the account portal. Members are then asked to set up 2FA the next time they open the app or sign in (Termius).
Turn on 2FA with an authenticator app
You can do this in four places. The account portal and the desktop app show a QR code. The iPhone and Android apps give you a code to copy instead (Termius).
On the account portal (account.termius.com) or the desktop app:
- On the portal, open the Account page and turn on Two-factor authentication. In the desktop app, go to Termius > Settings > Account and turn on Enable 2FA.
- Choose TOTP - Google Authenticator, Duo, etc. as the provider.
- Click Continue and enter your encryption password.
- In Novaz, tap +, then Scan QR code, and point the camera at the QR code on your screen.
- Type the code Novaz shows into Termius to finish.
In the Termius app on iPhone:
- Open Profile, tap your email address, and turn on 2FA.
- Choose TOTP - Google Authenticator, Duo, etc. and enter your encryption password.
- Termius shows a code to copy. Copy it, then switch to Novaz.
- In Novaz, tap +, then Enter key manually. Type Termius as the Service, your email as the Account if you like, and paste the code into Setup key. See What is a 2FA setup key?
- Switch back to Termius and enter the code from Novaz.
On Android, the path is Settings > Account settings > Enable 2FA, and the rest matches the iPhone steps.
Termius doesn't say how many digits its codes have or how often they change. If Termius won't accept codes from a key you typed or pasted, turn the setting off and set it up again on the portal or desktop, where you can scan the QR code. A QR code carries the code settings with it.
No backup codes
None of Termius's 2FA instructions mention backup or recovery codes, and none of its help pages describe another way to sign in when the authenticator is gone. Unless you turn on Novaz's iCloud backup or keep a backup file, its keys exist only on that iPhone, and that phone is the only thing standing between you and the reset described below.
Keep your encryption password in a password manager, as Termius itself recommends (Termius): you need it both to turn 2FA off and to move it to a new phone. For general advice on recovery options, see 2FA backup codes.
If Termius rejects your code
Termius's documentation has no advice on rejected codes. Start with the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
Termius doesn't describe moving 2FA to a new phone. What it does document is turning 2FA off and on again, and turning it off asks for your encryption password plus a current code. So do the switch while you still have the old iPhone: turn 2FA off, then turn it on again and scan the QR code with the new phone. With Novaz's iCloud backup or a backup file, you can instead restore your accounts on the new iPhone and keep the same Termius codes. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Termius's account documentation says that if you forgot your encryption password or lost access to 2FA, you can reset to get back into the account. The catch is that after the reset, the app can't decrypt the data you synced before, so you start over (Termius). Your encryption password is the key to the vault, so not even Termius staff can recover the data. The reset happens on the portal's forgot password page, which removes the old vault and creates a new one (Termius).
Termius doesn't describe any identity check or other way to keep your data, and doesn't say how long the reset takes. If you're unsure, submit a request to Termius support before you reset. Its documentation points there when an account step doesn't work. More in Lost the phone with your authenticator app?
Turning 2FA off
On the portal, turn off Two-factor authentication on the Account page. In the desktop app, turn off Enable 2FA under Termius > Settings > Account. On iPhone, open Profile, tap your email, then the three-dots button and Disable 2FA. Each route asks for your encryption password and a verification code (Termius). Then remove the Termius entry from Novaz: open it and tap Remove account.
