Setting up two-factor authentication (2FA) in Nextcloud

Every Nextcloud from WebOké has two-factor authentication (2FA) enabled by default with a code by email. After your password, you'll get an email with a code, which you enter to log in. This is on for everyone and can't be turned off. In addition, you can set up a more secure method yourself: an authenticator app, which Nextcloud calls TOTP (Time-based One-Time Password, a code that changes every 30 seconds).

Setting up an authenticator app

1. Install an authenticator app on your phone, for example Microsoft Authenticator, Google Authenticator, Aegis, or the authenticator in your password manager.
2. In your Nextcloud, click your profile picture in the top right, choose Settings, and click Security on the left.
3. Check the box next to Enable TOTP. If Nextcloud asks for your password, enter it.
4. Scan the QR code with your app. If you can't scan it, type in the secret key shown above the QR code instead.
5. Type the code from your app into the field for the test code and click Verify. Only then is TOTP turned on.

Creating and safely storing backup codes

If you lose your phone, you'll no longer have your app. So create backup codes right away: on the same page, under Backup code, click Generate backup code. You'll get ten codes, each of which works once.

• Don't store them on the same phone as your app, and not as a loose file on your computer where anyone can access it.
• Store them, for example, in your password manager, or printed with your important papers.
• You only see the codes once. If you generate new codes, the old ones stop working.

Logging in with a passkey or security key

Under Log in without password on the same page, you can link a passkey or a security key, such as a YubiKey. This is an extra way to log in; your other methods will keep working.

Explanation with screenshots: Setting up an authenticator app and storing backup codes, The login code by email: how it works and what to do if the email doesn't arrive, and Lost your phone or lost 2FA: how to get back in in the Nextcloud manual.