Skip to content
Novaz AuthenticatorGET

WEB.DE 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Before you start
  2. Turn on 2FA with an authenticator app
  3. Mail programs and apps afterward
  4. When WEB.DE asks for a code
  5. One secret key instead of backup codes
  6. If WEB.DE rejects your code
  7. Changing phones
  8. If you lose your authenticator
  9. Turning 2FA off
  10. Official WEB.DE help

WEB.DE is a German email service. Two-factor authentication on your WEB.DE mailbox, called Zwei-Faktor-Authentifizierung, is optional and free (WEB.DE). The second factor is a 6-digit code from an authenticator app. Setup also has you confirm a mobile number by text, but that number is for password recovery.

The catch: you can't finish setup without the WEB.DE Mail App on a smartphone, because WEB.DE asks you to confirm there (WEB.DE). This guide uses Authenticator App - Novaz on iPhone for the codes. Any authenticator app works the same way.

How we checked this guide: the WEB.DE steps come from WEB.DE's own help center and 2FA page, linked below, which we read on October 19, 2026. The pages are in German; the English in parentheses is our translation. We haven't tested the steps on a WEB.DE account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

WEB.DE asks for three things first (WEB.DE):

  • The current WEB.DE Mail App, signed in to your account with notifications on.
  • An authenticator app, which you shouldn't delete afterward.
  • An up-to-date postal address. If you lose your emergency key, customer service can post new access details there. Check it under Persönliche Daten (Personal data) (WEB.DE).

Turn on 2FA with an authenticator app

On a computer, sign in at web.de, then follow WEB.DE's help (WEB.DE):

  1. Click the icon with your initials in the top bar, then Account verwalten (Manage account).
  2. Click Login & Sicherheit (Login & security) on the left and scroll to the bottom.
  3. Click Zwei-Faktor-Authentifizierung aktivieren (Activate two-factor authentication), then Jetzt Einrichtung starten (Start setup now) and Ja, weiter (Yes, continue).
  4. Enter your password and click Jetzt starten (Start now).
  5. On your phone, tap the push notification from "WEB.DE Sicherheit" (WEB.DE Security), then Ja, das war ich (Yes, that was me). No notification? Sign out of the Mail App and back in, then start again.
  6. Confirm your mobile number, using Ändern (Change) if it's out of date. Click SMS anfordern (Request SMS), enter the texted code and click Weiter (Next).
  7. WEB.DE shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  8. Can't scan it? Click Code in die Zwischenablage kopieren (Copy code to clipboard) under the QR code. This "code" is the setup key. In Novaz, tap +, then Enter key manually, and enter that key as the Setup key. See What is a 2FA setup key?
  9. Enter the 6-digit code from Novaz and click Weiter.
  10. Click Geheimschlüssel sichern (PDF) (Save secret key) to download your emergency key. Check your details, click Weiter, then Jetzt aktivieren (Activate now).

WEB.DE's scanning help (WEB.DE) calls the copy button Code kopieren (Copy code), and its 2FA page calls the menu Sicherheit (Security), so labels may differ. If you send the key to your phone in a message, as that help suggests, delete the message afterward.

WEB.DE doesn't say how often its codes change, so scan the QR code if you can. It carries the code settings, while a key typed into Novaz gets 30 seconds.

Mail programs and apps afterward

Sign in again once in the WEB.DE Mail App and in MailCheck. Programs that use POP3/IMAP, CalDAV or CardDAV, such as Outlook or Thunderbird, need an app password instead of your password, and you may have to switch POP3/IMAP back on (WEB.DE). Create one under Login & Sicherheit > App-Passwörter (für externe Apps) (App passwords). WEB.DE shows it only once (WEB.DE).

When WEB.DE asks for a code

In a browser, WEB.DE asks every time you sign in. The Mail App asks only once (WEB.DE).

Ticking Für dieses Gerät merken (Remember for this device) on the code page skips codes on that device, so use it only on your own. To undo it, delete that browser's cookies; unticking the box doesn't (WEB.DE).

Don't confuse this with Login mit App bestätigen (Confirm login with app), a separate check for unknown devices that doesn't use your authenticator (WEB.DE).

One secret key instead of backup codes

There are no backup codes. You get one single-use Geheimschlüssel (secret key) in a PDF, which WEB.DE recommends printing. It isn't for sign-in: you enter it during a password reset, and that turns 2FA off. It's meant for a lost, broken or new phone, a new number, or a forgotten password (WEB.DE).

If your phone is lost and you have no Novaz backup (iCloud backup or a backup file), this printout is your way back in. Store it away from your phone. See 2FA backup codes.

If WEB.DE rejects your code

WEB.DE's help says the code may have expired: enter the next one straight away (WEB.DE). Also check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More in Authenticator code not working?

Changing phones

WEB.DE doesn't describe moving the authenticator. While you still have the old phone, turn 2FA off with a code from it (below), then run the setup again. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

  1. Start WEB.DE's password reset at assistent.web.de/recovery, enter your email address and pass the security check.
  2. Confirm it's you with a code sent to your mobile number or contact email address.
  3. Enter your Geheimschlüssel and click Weiter. WEB.DE turns 2FA off. Choose a new password and click Passwort speichern (Save password) (WEB.DE).
  4. Sign in and set up 2FA again.

Lost the PDF too? Check your downloads folder. Otherwise, open the WEB.DE Hilfe-Chat (help chat), the speech-bubble icon on the help pages. Customer service can post access details to the address in your account, but may not help if it can't confirm you own the account (WEB.DE). It won't if the address doesn't match (WEB.DE). WEB.DE doesn't say how long this takes. More in Lost the phone with your authenticator app?

Turning 2FA off

In Login & Sicherheit, click Zwei-Faktor-Authentifizierung deaktivieren (Deactivate two-factor authentication), enter your password and a code from Novaz, and click Weiter (WEB.DE). Then open the WEB.DE entry in Novaz and tap Remove account.

Official WEB.DE help

All in German:

More guides: Email