Tuta 2FA: how to set up an authenticator app

Tuta, the encrypted email and calendar service that used to be called Tutanota, lets you add a second factor to your login: a security key (U2F) or an authenticator app (TOTP) (Tuta). What's unusual is recovery. Tuta can't reset your login for you, and its help mentions no backup codes. If you lose your authenticator, you get back in with your password plus your 64-character recovery code (Tuta). So find that code first.

Two-factor authentication (2FA) is optional but recommended. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Tuta steps come from Tuta's own support page and blog, linked below, which we read on October 21, 2026. Tuta's support page builds its answers with JavaScript, so we read the English answers in the text file that page loads from tuta.com. We haven't tested the steps on a Tuta account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: find your recovery code

Tuta asks you to note down the recovery code it shows when you add a second factor (Tuta). To see it again while signed in, go to Settings > Login and select the pencil icon next to Recovery code. You'll need your password (Tuta). Keep the code on paper or in a password manager, away from your phone.

Turn on 2FA with an authenticator app

Tuta's help gives the location (Tuta):

1. Sign in to Tuta on the web, in the desktop app or in the mobile app.
2. Go to Settings > Login and register a second factor there, choosing the authenticator app (TOTP) type.
3. If Tuta shows a QR code, in Novaz tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. If you can only copy a key, in Novaz tap +, then Enter key manually, fill in Service and Setup key, and save. See What is a 2FA setup key?
5. Type the code from Novaz into Tuta to confirm, and write down the recovery code Tuta shows you.

Tuta's help doesn't describe the setup screen itself: no button names, no word on a QR code or text key, no code length. If there's a QR code, scan it, since it carries the code settings to Novaz. A typed key always gets 6 digits every 30 seconds.

Admins can add second factors for users under Settings > User management. On a paid multi-user account, Require 2FA for all users under Settings > Global settings makes users add one at their next login (Tuta).

Add a spare, and how login works

Tuta lets you register several second factors and suggests it, so losing one doesn't lock you out (Tuta). A security key makes a good spare. Tuta's blog notes that an authenticator on the same phone as your Tuta app doesn't truly protect that phone's login (Tuta).

At login you confirm with one of your second factors, or approve the new session from a Tuta app where you're already signed in (Tuta).

If Tuta rejects your code

Tuta's advice is about time: both Tuta and your authenticator need the correct time and time zone, and some browsers or browser extensions block access to the system's time zone (Tuta). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and keep the same codes. Without one, use the fact that Tuta accepts several second factors: add Novaz on the new iPhone as an extra second factor while the old phone still works, then remove the old one. Tuta's help doesn't describe how to remove a single second factor, only that "only admins can remove assigned second factors" (Tuta). On a single-user account, you are the admin. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use another second factor if you registered one. Otherwise, on Tuta's login page, select More, then Lost account access, and enter your recovery code and your password. This deletes all your second factors (Tuta).

The rule is two out of three. With 2FA on, resetting your password takes your second factor and recovery code, and resetting your second factor takes your password and recovery code. If you lose both your password and your second factor, Tuta says the account can't be reset (Tuta).

Without the recovery code, Tuta can only help on a paid plan with a PayPal account or credit card stored on the account. You contact Tuta in English or German, and it checks ownership against that payment data. For free accounts, Tuta says it has no way to verify ownership and can't help (Tuta). It doesn't say how long a request takes. More in Lost the phone with your authenticator app?

Official Tuta help

• Setting up a second factor (2FA) in Tuta
• Does Tuta support two-factor authentication (2FA)?
• How do I reset my password or second factor?
• What do I do if I have lost my recovery code?
• I can't access my account
• How to enforce two-factor authentication (2FA) for all users?
• What is U2F used for and what are the benefits?