TunnelBear 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your TunnelBear account is the one behind the VPN apps for Windows, macOS, iOS and Android, and behind your subscription on tunnelbear.com. Two-factor authentication (2FA) is optional and free. You can switch it on from the VPN app itself or from the website, and once it's on, it covers every TunnelBear app on the account, not just the device you set it up from (TunnelBear).
TunnelBear offers two methods: app authentication, which uses a third-party authenticator app, and email authentication, which sends a one-time code to the address on your account. The difference that matters most: only the authenticator app method gives you backup codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the TunnelBear steps come from TunnelBear's own help center, linked below, which we read on October 21, 2026. The help center's web pages block automated readers, so we read the articles through the help center's public article feed and compared the 2FA article with an archived copy on web.archive.org from June 11, 2026; the text matched. We haven't tested the steps on a TunnelBear account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Where the setting is
TunnelBear puts the switch in a different place on each platform (TunnelBear):
- Phone or tablet: open the TunnelBear app's settings and scroll down to Two-Factor Authentication.
- Windows or Mac: open the app's settings and choose the General tab.
- Website: sign in at tunnelbear.com, then go to My Account > Security.
TunnelBear says the steps after that are the same wherever you start. The website is the easiest place if the VPN app is on the same iPhone as Novaz, because you can scan the QR code from a computer screen.
Turn on 2FA with an authenticator app
- Open the 2FA setting from one of the places above and turn it on.
- Enter your TunnelBear password when asked.
- Choose App authentication rather than email.
- TunnelBear shows a QR code and a code you can type in by hand. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If the code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan, tap +, then Enter key manually in Novaz. Type "TunnelBear" as the Service and the code TunnelBear shows as the Setup key. The help article calls it a "numerical code" (TunnelBear); more on these keys in What is a 2FA setup key?
- Type the 6-digit code Novaz shows into TunnelBear to finish.
TunnelBear's article doesn't say how often its codes change. Scanning the QR code is the safer choice, since it passes the code settings to Novaz.
Save your backup codes
The authenticator method lets you download backup codes, and TunnelBear strongly recommends generating them and storing them somewhere secure (TunnelBear). Its article doesn't say how many codes you get, whether each works only once, or exactly where the download button is.
Treat this step as required if you use Novaz. Unless you've turned on iCloud backup or exported a backup file, Novaz's keys exist only on that iPhone, so the backup codes are what get you in if it's lost or reset. Keep them on paper or in a password manager, not only on the same phone. See 2FA backup codes.
When TunnelBear asks for a code
TunnelBear's article is not fully consistent here. One part says the authenticator gives you a code each time you sign in. The closing part says you'll need a code when you sign in on a new device (TunnelBear). Expect at least a prompt on every new device.
If TunnelBear rejects your code
TunnelBear's help doesn't cover rejected codes. The usual cause is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
TunnelBear doesn't document a way to move the authenticator to a new phone. With a Novaz iCloud backup or backup file, you restore your accounts on the new iPhone and TunnelBear's codes keep working. Without one, a new iPhone means adding TunnelBear to Novaz again. Since the TunnelBear article doesn't describe turning 2FA off or resetting it, do this while you still have the old phone and your backup codes, and contact support if the setting doesn't let you start over. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use one of your backup codes to sign in. If you can't get into your account after turning on 2FA, TunnelBear's article points you to its support team (TunnelBear). The TunnelBear support page asks you to sign in before you can write to support, and offers an Unable to log in? link for people who can't. TunnelBear doesn't say what proof it asks for or how long a reset takes.
More in Lost the phone with your authenticator app?
