Skip to content
Novaz AuthenticatorGET

TU Darmstadt 2FA: how to set up an authenticator app for your TU-ID

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Plan for two tokens
  2. Turn on 2FA and save the recovery codes
  3. Add your authenticator app
  4. Signing in with a code
  5. If TU Darmstadt rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official TU Darmstadt help

Your TU-ID signs you in to TU Darmstadt's single sign-on (SSO), including TUCaN, the IDM portal and GitLab, and to the university VPN. Two-factor authentication (2FA) on it is mandatory for every TU-ID and TU-TechID (TU Darmstadt), and since March 18, 2026, SSO won't let you in without it (TU Darmstadt). The HRZ (Hochschulrechenzentrum, the university's computing center) also announced that from July 2026, TU-IDs without 2FA would be blocked. Only the HRZ Service can then unblock them, which may take several days (TU Darmstadt).

There are no text-message codes. The second factor, which HRZ calls a token, can be time-based codes (TOTP) from an authenticator app, the TUDa app or a password manager, a hardware key, or Windows Hello (TU Darmstadt). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the TU Darmstadt steps come from the HRZ's own help pages and PDF instructions, linked below, which we read on October 19, 2026. We haven't tested them on a TU-ID, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Plan for two tokens

HRZ strongly recommends at least two tokens, ideally a phone app plus a TOTP in a password manager such as KeePassXC (TU Darmstadt). Unless you back up Novaz with iCloud backup or a backup file, its keys exist only on that iPhone, so that second token is your backup. Keep a TOTP token even if you add Windows Hello or a security key: the VPN and Cisco Jabber only accept TOTP or HOTP codes. Allow about 30 minutes and finish without a break, as HRZ asks.

Turn on 2FA and save the recovery codes

HRZ's activation guide, dated February 11, 2026, describes these steps (TU Darmstadt):

  1. Go to login.tu-darmstadt.de/2fa, also linked as 2FA-Management beside the SSO sign-in form, and sign in with your TU-ID and password.
  2. On the welcome page, click Continue, then OK.
  3. Click Continue again. You get a numbered list of 10 recovery codes, 6 digits each.
  4. Click Print the OTP List, or save the codes somewhere safe. Tick I saved the recovery codes. and click Continue.

2FA is now on, and you'll get a confirmation email. The recovery codes only open 2FA management, not other services, so add your authenticator app before you leave.

Add your authenticator app

From HRZ's authenticator-app guide (TU Darmstadt):

  1. In 2FA management, click Enroll Token and choose TOTP. The first field is already filled in; leave it.
  2. Type a name in Description (required), such as "iPhone Novaz", and click Continue. You'll pick your token by this name when you sign in.
  3. A QR code appears. In Novaz, tap +, then Scan QR code. If the QR code is on your iPhone's screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  4. Can't scan it? Beside the QR code, 2FA management shows the secret key as text. In Novaz, tap +, then Enter key manually, and type it as the Setup key. HRZ's screenshots show 6-digit codes every 30 seconds with SHA1, which matches Novaz's typed-key settings. See What is a 2FA setup key?
  5. Type the 6-digit code from Novaz into the field under the QR code and click Verify Token.

Click All tokens to see your list. HRZ's guides vary in how they capitalize labels. A browser set to German shows German labels such as Token ausrollen (Enroll token) and Token verifizieren (Verify token) (TU Darmstadt).

A TU-TechID needs its own token, and so its own Novaz entry, because a token belongs to one account only (TU Darmstadt).

Signing in with a code

SSO asks for a code at every sign-in, which HRZ expects is once or twice a day (TU Darmstadt). After your TU-ID and password, pick your token under Please select token., click Next, type the code and click Validate (the guide's text says Verify). Choose new Token switches tokens (TU Darmstadt).

Computer login, Exchange/Outlook and Microsoft 365 don't check the second factor yet. Students taking e-exams should have a TOTP token on a second device, such as a phone, to sign in before the exam (TU Darmstadt).

If TU Darmstadt rejects your code

HRZ's fix for a TOTP token that stops working is to resynchronize it (TU Darmstadt):

  1. Sign in to 2FA management, with a recovery code if you have to, and select the token.
  2. Type two consecutive codes from Novaz into the fields next to Resynchronise token, waiting for the code to change in between. Then click Resynchronise token.

Also check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More in Authenticator code not working?

Changing phones

HRZ's two-token advice also covers new devices (TU Darmstadt). Before you give up the old iPhone, sign in to 2FA management, enroll a new TOTP token with Novaz on the new phone, test it, then delete the old token. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

  • You have another token or a recovery code: sign in to 2FA management with it, delete the lost token and enroll a new one (TU Darmstadt). With another token, you can also make new recovery codes there.
  • You have neither: HRZ's activation guide warns that "you could be permanently locked out." Its FAQ says the HRZ Service can reset 2FA after checking a valid ID document. You then set 2FA up again (TU Darmstadt). Reach the HRZ Service through its contact form or at +49 6151 16-71112. HRZ doesn't say how long a reset takes.

More in Lost the phone with your authenticator app? and 2FA backup codes.

Turning 2FA off

You can't: only the HRZ Service can reset it, and it's mandatory anyway (TU Darmstadt). To retire Novaz, add another token, delete the Novaz token in 2FA management, then open the entry in Novaz and tap Remove account.

Official TU Darmstadt help

More guides: Universities and education