VRChat 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
First, check how you sign in to VRChat. Its two-factor authentication (2FA) only covers full VRChat accounts, registered with an email address. If you play through a Steam, Meta (Oculus) or Viveport login instead, VRChat points you to those services' own security settings (VRChat). For a VRChat account, 2FA is optional, though VRChat's help center strongly recommends an authenticator app (VRChat).
You set it up on the VRChat website, not in the game. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the VRChat steps come from VRChat's own documentation and help center, linked below, which we read on October 21, 2026. The help center blocks automated page requests, so we read its articles through the help center's public article feed. We haven't tested them on a VRChat account, and the documentation's screenshots are from 2022, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
VRChat's documentation describes these steps (VRChat):
- In a web browser, sign in at vrchat.com/home/login.
- Click Edit Profile at the top left. VRChat's newer help article calls this your Profile page, so the label may differ slightly.
- Scroll to the Two-Factor Authentication section and click Enable.
- Skip the app suggestion on the first step and click Next >.
- VRChat shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're on the VRChat website on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, click the link to enter the key manually. VRChat shows a long text key. In Novaz, tap +, then Enter key manually, type VRChat as the Service, and paste the key as the Setup key. See What is a 2FA setup key?
- Click Next > on the website.
- Type the 6-digit code from Novaz and click Verify.
VRChat's codes are six digits and change every 30 seconds, so a typed key works the same as a scanned one. When setup succeeds, the page says "You are protecting your account with an additional login step." (VRChat).
Download the recovery codes right away
The same success screen offers recovery codes. VRChat gives you ten, and each one works once. You might be asked for another authenticator code before you can view or download them (VRChat). VRChat warns that skipping this can cost you the account for good.
VRChat's page suggests an app with cloud backup. In Novaz that's iCloud backup (PRO) under Settings › Backup, or you can export a password-protected backup file for free. Keep the recovery codes either way: they get you in if the phone is gone and your Novaz backup is missing or out of date. Keep them off your phone, on paper or in a password manager on another device. See 2FA backup codes.
When VRChat asks for a code
Not every time. VRChat says it may ask, especially when it's been a while since your last code or you seem to be signing in from a new place (VRChat).
In the VRChat client, click Enter code here..., type the code on the keypad, press OK, then Verify. The website and the creator SDK show a plain code box.
VRChat's sign-in help also mentions 2FA codes sent by email and what to do when they don't arrive (VRChat). Read the screen: a code from your app comes from Novaz, an emailed one from your inbox.
If VRChat rejects your code
VRChat's advice: check that the code hasn't just changed and that you typed it correctly. If setup won't finish, the grey Cancel button backs out and your password keeps working as before (VRChat).
If codes keep failing, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
VRChat's pages don't describe moving 2FA to a new phone. The documented route is to turn it off and set it up again (below), so do that while you still have the old phone. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Recovery codes are VRChat's documented way back in (VRChat):
- Sign in to the VRChat website with your username and password.
- On the 2FA screen, click Use a recovery code instead and type one of your codes. Cross it off your list afterwards.
- If the phone is gone for good, go to Edit Profile and turn 2FA off, then set it up again with Novaz.
In the client, the option is Use Recovery Code, best kept as a stopgap since you only have ten.
Without recovery codes, the official pages we read don't describe a support process for removing 2FA. More in Lost the phone with your authenticator app?
Turning 2FA off
On the website, open Edit Profile, scroll to Two-Factor Authentication and click Disable. You may need to confirm with an authenticator code or a recovery code. Turning it off cancels both your app codes and your recovery codes, so turning it back on means starting over (VRChat). Remove the old VRChat entry from Novaz too: open it and tap Remove account.
