Toontown Rewritten 2FA: how to set up an authenticator app

Toontown Rewritten is the free, fan-run revival of Disney's Toontown Online, and your account holds every Toon you've built up. The game has two security features, and they're easy to mix up. ToonGuard is on for every new account and emails you a code when you sign in from a new location. Two-Step Login is the optional one: it asks for a 6-digit code from an authenticator app every time you log in (Toontown Rewritten, Toontown Rewritten).

Toontown Rewritten doesn't document backup codes. If you lose the phone, the way back in is an email to Support with log files from your computer.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way; Toontown Rewritten's own posts name Authy and Google Authenticator as examples.

How we checked this guide: the Toontown Rewritten steps come from Toontown Rewritten's own help pages and official news posts, linked below, which we read on October 21, 2026. The Two-Step Login settings page itself is only visible after you sign in, and we didn't sign in, so we haven't seen it or tested the steps on a Toontown Rewritten account. A label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on Two-Step Login

The help pages call it Two-Step Login; the news posts call the same thing Two-Factor Authentication (Toontown Rewritten).

Toontown Rewritten's FAQ only says to go to the Account page, where you can read about Two-Step Login and enable it (Toontown Rewritten). It doesn't list the screens after that, so steps 3 to 6 cover the usual cases:

1. Sign in on the Toontown Rewritten website.
2. Open your Account page. The Two-Step Login settings live at toontownrewritten.com/account/twoStep, which the FAQ links to directly (Toontown Rewritten).
3. Follow the on-screen instructions to link an authenticator app.
4. If the page shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If the page shows a text key instead, tap +, then Enter key manually in Novaz. Type "Toontown Rewritten" as the Service, your username as the Account if you like, and the key as the Setup key. See What is a 2FA setup key?
6. Enter the 6-digit code Novaz shows to finish, if the page asks for one.

The official pages don't say whether a text key is offered. They do say the codes are 6 digits, which matches what Novaz makes from a typed key. Scanning is still the safer choice.

When you'll need a code

Every time you log in, not just on new devices (Toontown Rewritten). That's the trade-off Toontown Rewritten itself points out when it compares the two features: ToonGuard stays quiet unless something looks off, while Two-Step Login asks each time. The FAQ recommends turning on both (Toontown Rewritten).

No backup codes, so save your log files

None of the official pages mention backup or recovery codes. Your fallback is proof of ownership through log files, the small text files the game writes each time you play (Toontown Rewritten). Support uses them to confirm the account is yours. On Windows they're in the logs folder inside the Toontown Rewritten install folder. On a Mac they're in ~/Library/Application Support/Toontown Rewritten/logs.

So don't delete old log files: Support asks for ones at least a week old. And never send them to anyone except Toontown Rewritten Support by email: Toontown Rewritten warns that log files can be used to steal accounts (Toontown Rewritten).

A Novaz iCloud backup or backup file can bring your codes back on a new iPhone, but without one, Novaz's keys exist only on that phone, so keep the log files either way.

If your code is rejected

Toontown Rewritten's pages don't cover rejected codes. The usual cause is the phone's clock. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Also check you're typing the right code. A ToonGuard code comes by email and is valid for about 30 minutes (Toontown Rewritten). The Two-Step Login code comes from Novaz and changes constantly.

Turning it off or changing phones

While you still have the old phone, open the Account page, select Disable Two-Step Login and follow the instructions (Toontown Rewritten). Toontown Rewritten doesn't describe a separate way to move it to a new phone, so the clean route is to turn it off, then set it up again on the new phone. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Email support@toontownrewritten.com from the email address currently on your account. Include your username and two log files that are each at least one week old. Once Support confirms you own the account, it removes Two-Step Login (Toontown Rewritten).

If you have no log files, Support can verify you with detailed account information instead: your Toon names and looks, when and where you created the account, the internet providers you've used, previous email addresses and similar details (Toontown Rewritten). The pages don't say how long either route takes. More in Lost the phone with your authenticator app?

Official Toontown Rewritten help

• Accounts & Login FAQ
• Help - ToonGuard
• Stay Safe, Toons! (news post, November 4, 2020)
• Safe Safe-ty with Franz Neckvein (news post, September 13, 2022)