Skip to content
Novaz AuthenticatorGET

Tumblr 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Before you start
  2. Turn on 2FA with an authenticator app
  3. Save your backup codes
  4. When Tumblr asks for a code
  5. If Tumblr rejects your code
  6. If you lose your authenticator
  7. New phone, or turning it off
  8. Official Tumblr help

One Tumblr sign-in covers your primary blog and every sideblog you've added to the account (Tumblr). Two-factor authentication, which Tumblr shortens to TFA, isn't required for anything, but Tumblr strongly recommends it (Tumblr).

Since March 2025, an authenticator app is the only method for a new setup: Tumblr stopped offering text-message codes to anyone not already using them (Tumblr). Single-use backup codes come with it. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Tumblr steps come from Tumblr's own Help Center and its official Changes blog, linked below, which we read on October 20, 2026. We haven't tested them on a Tumblr account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

  • Verify your email address. Until you do, two-factor authentication may not be available (Tumblr).
  • Still getting codes by text? Tumblr says SMS "will continue to work until disabled" (Tumblr). Once you turn it off, expect an app to be the only choice.

Turn on 2FA with an authenticator app

On the web (Tumblr):

  1. Click Settings in the left sidebar, or go straight to tumblr.com/settings/account.
  2. In the Security section, turn on Two-factor Authentication.
  3. Enter your Tumblr password.
  4. Tumblr shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
  5. Follow Tumblr's prompts and confirm with the code Novaz shows. Tumblr's help doesn't name these last screens.

In the Tumblr app, tap the account icon, then the gear icon at the top right, then General settings (on Android, Account settings) and Security (Tumblr). A newer Tumblr article, from October 2026, calls that settings entry Account, so labels may differ (Tumblr).

If the QR code is on the iPhone you're holding, take a screenshot, then in Novaz tap + and Choose a photo. See scanning a QR code on the same iPhone.

If you can't scan the QR code

Tumblr lets you copy a setup code instead (Tumblr). In Novaz, tap +, then Enter key manually, fill in Service and, if you like, Account, and paste the code as the Setup key. See What is a 2FA setup key?

Still, scan if you can. In its December 2025 changelog, Tumblr said pasting the text code wasn't activating two-factor on the web, while the QR code worked (Tumblr). Later changelogs we read don't mention a fix. Tumblr also doesn't say how long its codes are or how often they change, and a typed key in Novaz always gets 6 digits every 30 seconds.

Save your backup codes

On the web, click Generate backup codes in the Security section of Settings, enter your password and click Check Password. You get ten codes to copy or print with Print Codes. In the app, tap Generate new backup codes under Security, then take a screenshot or tap Copy (Tumblr). Each code works once (Tumblr).

Keep them even if you back up Novaz: they get you in if the phone is lost without an iCloud backup or backup file. Store them away from the phone. Tumblr doesn't say whether a new set cancels the old one, so keep only the newest. More in 2FA backup codes.

When Tumblr asks for a code

  • Signing in: every time, after your password (Tumblr). Tumblr doesn't mention trusted devices, or how this works with Continue with Google or Continue with Apple.
  • Resetting your password: a reset also asks for the code from your authenticator app. Tumblr won't email it to you (Tumblr).

If Tumblr rejects your code

Tumblr's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when your clock is 15 seconds or more off. Meanwhile, a backup code gets you in. Other causes are in Authenticator code not working?

If you lose your authenticator

Type one of your backup codes where Tumblr asks for the verification code (Tumblr).

Without them, go to tumblr.com/support, choose Account access, fill in your account details, and under How can we help? select I can't get two-factor authentication codes (Tumblr). The proof is the account's email address: without access to it, Tumblr says it can't recover the account (Tumblr). If you hid your email with Sign in with Apple, Support needs to hear from that privaterelay.appleid.com address (Tumblr). Tumblr doesn't say how long it takes.

More in Lost the phone with your authenticator app?

New phone, or turning it off

Tumblr doesn't describe moving two-factor to a new phone, only turning it off and setting it up again from the start (Tumblr):

  • Web: in Settings, turn off Two-factor Authentication in the Security section, enter your password, and click Disable.
  • App: in Security, use the toggle, enter your password, and tap Disable Two-Factor.

For a new iPhone, do that while the old one still shows codes, then scan the new QR code with the new phone and make fresh backup codes. If you have a Novaz iCloud backup or backup file, you can skip this and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

Tumblr always emails you when two-factor is turned off (Tumblr). If that wasn't you, change your password and contact Support (Tumblr).

Official Tumblr help

More guides: Messaging and social