VirusTotal 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
You sign in to VirusTotal to comment on file and URL reports, get your API key, or use your company's paid VirusTotal tools through a group. Two-factor authentication (2FA) is optional on a personal account, but a group administrator can make it mandatory for everyone in the group. VirusTotal supports two methods: 6-digit codes from an authenticator app, and single-use offline backup codes (VirusTotal). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
VirusTotal's documentation is written mostly for group administrators. It says where personal 2FA lives but doesn't show the setup screens, so parts of this guide tell you what to look for rather than which button to press.
How we checked this guide: the VirusTotal details come from VirusTotal's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a VirusTotal account, and those pages don't show the personal setup screens, so the labels you see may differ. The Novaz steps are checked against the app, version 1.0.5.
Signing in with Google, GitHub or Microsoft doesn't skip it
You can sign in with a username and password, or with a Google, GitHub or Microsoft account. Either way, if 2FA is on for your account or enforced by your group, VirusTotal asks for its own code right after the other provider lets you through (VirusTotal).
Turn on 2FA with an authenticator app
- Sign in at virustotal.com and open the user menu: your username at the top right.
- Choose Settings. The menu shows Profile, API key and Settings (VirusTotal). VirusTotal's Google Threat Intelligence documentation names Settings as the place to configure 2FA (VirusTotal), and its administrators' guide says users can set up 2FA in their account settings (VirusTotal).
- Start the two-factor setup there and pick the authenticator app option. VirusTotal's pages don't name these buttons.
- If VirusTotal shows a QR code, open Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- If it shows a text key instead, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key? VirusTotal's pages confirm 6-digit codes but don't say how often they change. Scan the QR code if one is offered, because it carries the exact code settings.
- Type the current code from Novaz when VirusTotal asks for one, and save the backup codes it offers.
If your group enforces 2FA, VirusTotal brings you to the setup itself: new members while signing up, existing members at their next sign-in (VirusTotal). Your administrator picks 2FA App, Offline Codes or Any. With Offline Codes you can't choose an authenticator app, and with any enforcement you can't turn 2FA off. VirusTotal's pages don't describe turning it off on a personal account.
Offline backup codes
You can generate up to 30 single-use backup codes (VirusTotal). In a group that enforces offline codes, the administrator sets how many you get (10 to 100). VirusTotal warns you when you're running low, and at the last code you must make a new set before going on (VirusTotal).
If that iPhone is gone and you have no Novaz backup (iCloud backup or a backup file), or the backup is older than this account, the backup codes are your way in. Keep them off the phone. More in 2FA backup codes.
When VirusTotal asks for a code
You enter a code each time you sign in on the website. VirusTotal's pages don't mention a remember-this-device option. In a group, administrators set how long a session lasts and how much inactivity ends it, which decides how often you see the prompt (VirusTotal).
API requests use your API key instead, and VirusTotal says the key carries all your account's privileges (VirusTotal). Its pages don't say 2FA covers API calls, so guard the key like a password.
If VirusTotal rejects your code
VirusTotal's documentation has no advice on rejected codes. The usual cause is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If codes still fail, see Authenticator code not working?
Changing phones
VirusTotal doesn't document moving 2FA to a new phone. With a Novaz iCloud backup or backup file, you restore your accounts on the new iPhone and the codes carry on. Either way, keep the old phone and your backup codes until VirusTotal works on the new one. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Start with a backup code. If you have none left:
- In a group: ask any of your group administrators to reset your 2FA (VirusTotal). They do it from My group > USERS > Group Members, with the circular arrow icon next to your name (VirusTotal). After the reset you set up 2FA again.
- Personal account, no group: VirusTotal's pages only describe the administrator reset. Its documentation links a support contact page, but doesn't say whether support can reset 2FA, what proof it would ask for, or how long that takes.
More in Lost the phone with your authenticator app?
