Wikipedia 2FA: how to set up an authenticator app for your Wikimedia account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Two-factor authentication (2FA) on Wikipedia used to be only for editors with extended rights. Since December 2025, any registered account can turn it on (Wikimedia). It covers your global Wikimedia account, used on Commons, Wikidata and every language edition (Wikimedia). You can use an authenticator app or a security key, then add a passkey. There's no text-message option. This guide uses Authenticator App - Novaz on iPhone; any authenticator app works the same way.
How we checked this guide: the Wikipedia steps come from Wikimedia's own help pages and their screenshots, linked below, which we read on October 19, 2026. We haven't tested them on a Wikipedia account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Do you need it?
For most editors it's optional. Wikimedia requires it for sensitive permissions, such as checkuser, oversight, interface administrator, steward and bureaucrat, and removes those rights from accounts that don't turn it on (Wikimedia). Local administrators aren't on that list (Wikimedia).
One perk for everyone: without 2FA, Wikipedia sometimes emails you a login code on a new device or network. With 2FA on, those email codes stop (Wikimedia, Wikimedia).
Turn on 2FA with an authenticator app
The labels below come from the screenshots on Wikimedia's help page (Wikimedia).
- Log in with your password and open Special:AccountSecurity, for example on English Wikipedia. From your preferences, Manage next to Two-factor authentication: goes to the same place.
- Under Two-factor authentication, select Add an authenticator app. The page Enable Authenticator app opens.
- In Step 2: Give it a name, type a name you'll recognize, such as Novaz on iPhone.
- In Step 3: Scan the QR code, open Novaz, tap +, then Scan QR code. If the page is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Can't scan? The same step shows a Two-factor authentication secret key in groups of four characters. In Novaz, tap +, then Enter key manually: Wikipedia as the Service, your username as the Account, and the key as the Setup key. Wikipedia's codes are 6 digits every 30 seconds, so a typed key works (Wikimedia). See What is a 2FA setup key?
- In Step 4: Write down the recovery codes, select Copy or Download.
- In Step 5: Verification, type the code from Novaz and select Submit.
Wikimedia's written steps show the recovery codes after 2FA is on; its screenshot shows them during setup. Either way, save them before leaving.
Keep your recovery codes
You get ten single-use codes. You can view them again under Recovery options on Special:AccountSecurity whenever you're logged in. Adding another app or key doesn't create more (Wikimedia). After using one, select Create new recovery codes; the old set then stops working (Wikipedia).
If your iPhone is lost and you have no Novaz backup to restore, your recovery codes are how you get back in. Store them in a password manager or on paper. See 2FA backup codes.
Logging in
After your password, Wikipedia asks for the code from your app. Each code works for about two minutes. If you also registered a security key, the browser asks for it first, but you can switch to a code. The Wikipedia mobile apps don't support security keys, so you need an authenticator app to log in there (Wikimedia).
Tools such as AutoWikiBrowser don't support 2FA. Wikimedia suggests bot passwords for them (Wikimedia).
If Wikipedia rejects your code
Wikimedia's help blames the clock: a 2-minute difference can be enough to break codes (Wikimedia). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones
Add the new phone before removing the old one (Wikimedia). If you've restored a Novaz iCloud backup or backup file on the new iPhone, your Wikipedia codes already work there. Otherwise, on Special:AccountSecurity select Add an authenticator app again and scan the new code with Novaz on the new iPhone. Check that it works, then select Remove on the old entry. Your recovery codes stay the same (Wikimedia). See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Wikimedia's troubleshooting goes in this order (Wikimedia):
- Log in with another registered method, such as a security key.
- Otherwise, choose the recovery code option on the 2FA login page. In the Wikipedia mobile apps, type the recovery code where the app code goes.
- Once in, add a new authenticator, then remove the lost one.
With no method and no codes, email ca@wikimedia.org from the email address on your account and ask the Wikimedia Foundation to remove 2FA. It's a last resort: "WMF doesn't guarantee account recovery in this situation" (Wikimedia). If approved, you log in with just your password and set 2FA up again. Wikimedia doesn't say how long this takes.
Wikimedia's account recovery form covers a missing email login code, not 2FA (Wikimedia). See also Lost the phone with your authenticator app?
Turning 2FA off
On Special:AccountSecurity, remove each method. When the last one goes, 2FA is off and your recovery codes and passkeys are deleted (Wikimedia). Members of groups that require 2FA can't turn it off (Wikimedia).
