Webroot 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Webroot account is the one you use on the Webroot management website, my.webrootanywhere.com, to manage the devices your subscription protects. Without two-factor authentication (2FA), Webroot already asks for an extra step at every sign-in: a few characters from a personal security code you made when you created the account. Turning on 2FA swaps that step for a code from an authenticator app (Webroot).
2FA is optional. The only second factor Webroot offers is an authenticator app, with no text-message option (Webroot). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Webroot steps come from Webroot's own user guide and knowledge base, linked below, which we read on October 21, 2026. The pages on lost devices and rejected codes are written for business accounts, which sign in at the same address. A Webroot staff member's answer on the official community forum confirms the same reset for home accounts. We haven't tested the steps on a Webroot account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Webroot may offer the setup the first time you sign in, on a Setup 2FA screen. Choose Setup 2FA there, or Skip for now to do it later. To start it later (Webroot):
- Sign in at my.webrootanywhere.com. The address now forwards you to a sign-in page at identity.webrootanywhere.com (Webroot).
- Click your email address in the upper-right corner and choose Account Settings.
- Click Enable next to 2FA.
- Pick your security questions, then click Continue. Note the answers exactly as typed: they're your way back in if you lose your phone.
- Webroot shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, click Can't scan the QR code?. Webroot shows a text code and says it's case sensitive. In Novaz, tap +, then Enter key manually, and type the whole code as the Setup key, exactly as shown. See What is a 2FA setup key?
- Type the code from Novaz in the box under Step 4 and click Verify Code.
- When Verification Successful appears, click Complete Setup, then Go to Console.
Webroot then emails you from no-reply@webrootanywhere.com to confirm that 2FA is on.
Signing in afterwards
Each time you sign in, you enter your email address and password, then the code from Novaz, and click Confirm. The app's code takes the place of the security code characters (Webroot).
Don't delete your security code from memory, though. Webroot keeps it on your account and asks for it again whenever 2FA is turned off (Webroot).
No backup codes
Webroot's pages don't mention backup or recovery codes. Your fallback is the three security questions: the two you choose during 2FA setup and the one from when you created the account (Webroot). If you've forgotten the original answer, change it now, while you can still sign in: in Account Settings, click Change next to Security Question (Webroot).
If Webroot rejects your code
Webroot's codes last 30 seconds. If you see Verification Unsuccessful during setup, or an invalid code message at sign-in, wait for a fresh code and enter it before the timer in Novaz runs out (Webroot).
If fresh codes still fail, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
If you lose your authenticator
Webroot lets you turn 2FA off yourself from the sign-in screen (Webroot):
- Sign in with your email and password. On the authentication code screen, click Lost or Stolen Device?.
- On Account Verification, enter your email address and click Submit.
- Open the email from no-reply@webrootanywhere.com and click Reset 2FA.
- Answer your three security questions. Webroot says the answers are case sensitive.
Webroot then turns 2FA off, emails you to say so, and asks for your security code at the next sign-in. If you've lost that code too, a Webroot staff member's answer on the official forum says to use Forgotten Security Code? or Forgotten Password? on the sign-in page (Webroot Community, staff answer). Otherwise, contact Webroot Support; Webroot doesn't say how long that takes.
If you get an email saying 2FA was turned off and you didn't do it, Webroot says to contact Support to change your password (Webroot). See also Lost the phone with your authenticator app?
Changing phones
Webroot's FAQ treats a new phone the same as a lost one: turn 2FA off, then turn it back on once you have the new device (Webroot). While you still have the old iPhone, turn 2FA off in Account Settings (below), then click Enable again and scan the new QR code with Novaz on the new phone. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.
Turning 2FA off
In Account Settings, click Disable next to 2FA. Confirm the email address or phone number on your account and click Continue, enter the Authentication Code from Novaz and click Continue, then click Disable 2FA (Webroot). Afterwards, open Webroot in Novaz and tap Remove account.
