Mastodon Two-Factor Authentication Setup Walkthrough

Mastodon accounts are protected by email and password alone by default. This single-layer security can leave your account vulnerable if your password is stolen or leaked. Two-factor authentication adds a second verification step, requiring a time-based code from your phone. This article explains how to enable two-factor authentication on Mastodon using an authenticator app.

Mastodon supports two-factor authentication through TOTP apps such as Google Authenticator, Authy, or Microsoft Authenticator. The setup process takes about five minutes and requires your phone and a QR code. Once enabled, you will need both your password and a six-digit code each time you log in. This walkthrough covers the complete setup, including backup codes and recovery options.

How Two-Factor Authentication Works on Mastodon

Two-factor authentication on Mastodon uses the TOTP standard. TOTP stands for Time-based One-Time Password. Your authenticator app and Mastodon share a secret key. Every 30 seconds, both sides generate the same six-digit code using the current time. When you log in, Mastodon asks for this code in addition to your password. The code changes every 30 seconds, so a stolen code is only valid for a short window.

Mastodon stores the secret key on its server after you complete setup. The key is encrypted and associated with your account. Your authenticator app stores the key on your phone. If you lose your phone, you can use backup codes to regain access. Mastodon generates 10 backup codes during setup. Each code can be used once. Keep these codes in a safe place, such as a password manager or a printed paper.

You need a smartphone or tablet with an authenticator app installed. Free options include Google Authenticator for Android and iOS, Authy for Android and iOS, and Microsoft Authenticator for Android and iOS. You also need your Mastodon password. You cannot enable two-factor authentication without confirming your current password.

Steps to Enable Two-Factor Authentication on Mastodon

1. Log in to your Mastodon account
   Open your Mastodon instance in a web browser. Enter your email address and password. Click the Log in button.
2. Open Preferences
   Click your profile avatar in the top-right corner of the Mastodon interface. Select Preferences from the dropdown menu.
3. Go to Account settings
   In the left sidebar, click Account. This opens your account settings page.
4. Click the Two-factor Auth button
   Scroll down to the Two-factor Authentication section. Click the Set up two-factor authentication button. Mastodon prompts you to enter your current password. Type your password and click Confirm.
5. Scan the QR code with your authenticator app
   A QR code appears on the screen. Open your authenticator app on your phone. Tap the plus icon or Add account button. Select Scan a QR code. Point your phone camera at the QR code on your computer screen. The app adds your Mastodon account and starts displaying six-digit codes.
6. Enter the verification code from your app
   Look at the code displayed in your authenticator app for your Mastodon account. Type the six-digit code into the text box on the Mastodon setup page. Click Verify. Mastodon confirms that the code is correct and enables two-factor authentication.
7. Download and save your backup codes
   After verification, Mastodon shows a list of 10 backup codes. Click the Download backup codes button. Save the file to your computer. Alternatively, copy the codes and store them in a password manager. Each backup code can be used only once. Keep them accessible if you lose your phone.
8. Confirm the setup is complete
   Return to the Account settings page. The Two-factor Authentication section now shows a green checkmark and the text Enabled. Two-factor authentication is active for your account.

Common Issues and Mistakes During Setup

QR Code Does Not Scan

If your authenticator app cannot scan the QR code, check the brightness of your screen. Increase the screen brightness to make the QR code clearer. Make sure the QR code is fully visible and not cropped by the browser window. If scanning still fails, tap the manual entry option in your authenticator app. Mastodon provides a text key below the QR code. Copy that key and paste it into your app instead.

Verification Code Rejected

Mastodon rejects the code if your phone clock is not synchronized. TOTP codes depend on accurate time. Open your phone settings. Go to Date and Time. Enable automatic date and time synchronization. Wait 30 seconds for the code to refresh. Try entering the new code.

Lost Access to Authenticator App

If you lose your phone or uninstall the authenticator app, use one of your backup codes. Log in to Mastodon with your email and password. When prompted for the two-factor code, enter a backup code instead. After logging in, go to Preferences > Account > Two-factor Auth. Click Remove two-factor authentication. Then repeat the setup process with a new authenticator app.

Backup Codes Not Saved

If you did not download backup codes during setup, you cannot retrieve them later. Mastodon does not show backup codes again after you leave the setup page. You must disable two-factor authentication and re-enable it. During re-enablement, Mastodon generates new backup codes. Save them immediately.

Mastodon Two-Factor Authentication Setup: Authenticator Apps Compared

Item	Google Authenticator	Authy
Cloud backup	No	Yes, encrypted cloud sync
Multi-device support	No	Yes, install on multiple phones
Account recovery	Manual backup codes only	Cloud backup + backup codes
Platform availability	Android, iOS	Android, iOS, desktop
Open source	Yes	No

Two-factor authentication is now active on your Mastodon account. You will need both your password and a six-digit code from your authenticator app each time you log in. Test the login process immediately by logging out and logging back in with the code. Store your backup codes in a password manager for safekeeping. If you use multiple devices, consider Authy for its cross-device sync feature.