Nextcloud Two-Factor Authentication: Set It Up Without Locking Yourself Out
On Nextcloud 35 the authenticator option is already built in. Make app passwords for any app that signs in with your password, turn on the authenticator in your security settings, save the backup codes somewhere other than your phone, and as admin, require it for everyone.
On Nextcloud 35 the authenticator option is already built in. Turn it on under Personal settings, Security. Before you do, make an app password for every app that signs in with your normal password. Right after, generate your backup codes and keep them somewhere other than your phone. If you run the server, you can then require two-factor for everyone.
Everything below was checked in October 2026 on a fresh Nextcloud 35.0.1, the official Docker image on a Linux server, against the version 35 user and administration manuals.
Do I need to install an app for two-factor in Nextcloud?
Not on Nextcloud 35. The authenticator option ("TOTP (Authenticator app)") ships
switched on: it is in the list of default-enabled apps in Nextcloud 35's own
core/shipped.json, and a fresh install shows Enable TOTP under
Personal settings, Security. Older versions and older guides have you enable
"Two-Factor TOTP Provider" under Apps first, and the administration manual still says
it is disabled by default. On 35 that step is already done.
Any authenticator app works. The manual names Aegis and Google Authenticator.
Why make app passwords before turning it on?
An app cannot type a code from your phone. Nextcloud's security page says so right above the switch: "If you use third party applications to connect to Nextcloud, please make sure to create and configure an app password for each before enabling second factor authentication." The manual is blunter: with two-factor on, "device-specific passwords are the only way to configure clients. The server will then deny connections from clients using your login password."
We checked. With two-factor on, Nextcloud's WebDAV address answered the account password with "password login forbidden" and answered an app password normally.
Which apps need one? Apps that open a Nextcloud sign-in page in your browser handle the code there and receive their own app password automatically; Nextcloud's developer documentation calls this the login flow. Apps that only ask for a username and password in a box need an app password you make: calendar and contacts apps, a mapped network drive, rclone, backup scripts.
Make one under Personal settings, Security, Devices & sessions: type a name, Create new app password. It is shown once. If the device is lost, delete that one entry and nothing else changes.
What if I lose my phone?
Use a backup code. Generate them on the same page right after turning two-factor on: ten codes, each usable once, and Nextcloud will not show them again. Store them "separately so that losing one does not mean losing the other", as the manual puts it. At the login prompt, choose Use backup code.
With no phone and no codes, an administrator has to switch two-factor off for you from the server's command line. If you are the only administrator, that is you:
# Nextcloud installed directly on Linux (from the manual)
sudo -E -u www-data php occ twofactorauth:disable <user> totp
# Nextcloud in Docker (use your container's name)
docker exec -u www-data <container> php occ twofactorauth:disable <user> totp
# Check where an account stands
sudo -E -u www-data php occ twofactorauth:state <user>The user can then set up an authenticator again from their own settings.
How do I require two-factor for every account?
Administration settings, Security, Enforce two-factor authentication, then Save changes. Nextcloud asks for your password before it saves. Leave both group boxes empty and it applies to everyone. Enforced groups limits it to those groups; Excluded groups leaves a group out. If an account is in both, enforcement wins.
The settings page warns that people without two-factor configured "will be unable to log into the system". With the authenticator option available, what we saw was gentler: an account with nothing set up signs in with its password and is stopped at "Set up two-factor authentication. Enhanced security is enforced for your account." It has to set up an authenticator before it gets any further.
The checklist
- Make an app password for each app that asks for your password in a box.
- Personal settings, Security: Enable TOTP, scan the QR code, type the code, Verify.
- Generate backup codes straight away. Keep them away from your phone.
- Sign out and back in once, to see the code prompt work.
- Admins: Enforce two-factor authentication, for everyone or chosen groups.
What did the video leave out?
- Approving a sign-in from another device. Nextcloud 35 also ships "Two-Factor Authentication via Nextcloud notification", switched off. It uses a device that is already signed in as the second factor.
- Hardware keys. Nextcloud supports FIDO2 keys for passwordless sign-in. The manual warns not to use the same key for two-factor too, or you are back to one factor.
- Single sign-on. If Nextcloud signs people in through Keycloak, the second factor belongs in Keycloak. See our Nextcloud SSO with Keycloak guide.
- Codes rejected? The code depends on the time. The manual notes the server's and the phone's clocks must be almost in sync; a few seconds of drift is fine.
Full video transcript
1
00:00:00,000 --> 00:00:03,339
Here's how to turn on two-factor
in Nextcloud thirty five,
2
00:00:03,379 --> 00:00:05,029
without locking yourself out.
3
00:00:05,069 --> 00:00:08,000
Give your other apps their
own app passwords first.
4
00:00:08,040 --> 00:00:10,039
Save your backup codes right after.
5
00:00:10,079 --> 00:00:13,517
And if you run the server, you
can require it for everyone.
6
00:00:15,023 --> 00:00:18,309
This is Nextcloud thirty
five, the current release.
7
00:00:18,349 --> 00:00:21,570
It runs in Docker, on a
Linux server I run myself.
8
00:00:21,610 --> 00:00:24,414
We're in personal
settings, under Security.
9
00:00:25,644 --> 00:00:30,680
Two-factor means signing in takes two
things. Your password, which you know.
10
00:00:30,720 --> 00:00:33,552
And a code from your
phone, which you have.
11
00:00:33,592 --> 00:00:36,090
The code changes every thirty seconds,
12
00:00:36,130 --> 00:00:39,270
so a stolen password on
its own gets nobody in.
13
00:00:40,534 --> 00:00:44,161
On this version, the authenticator
option is already here.
14
00:00:44,201 --> 00:00:47,322
Older guides have you
install an app for it first.
15
00:00:47,362 --> 00:00:50,080
On thirty five, there's
nothing to install.
16
00:00:51,322 --> 00:00:53,611
Before you tick anything, read this line.
17
00:00:53,651 --> 00:00:57,019
If you use third party applications
to connect to Nextcloud,
18
00:00:57,059 --> 00:01:01,620
please make sure to create and configure
an app password for each before enabling
19
00:01:01,660 --> 00:01:03,307
second factor authentication.
20
00:01:04,567 --> 00:01:08,005
Here's why. An app can't
type a code from your phone.
21
00:01:08,045 --> 00:01:09,646
So once two-factor is on,
22
00:01:09,686 --> 00:01:13,780
any app that signs in with just
your password gets turned away.
23
00:01:13,820 --> 00:01:18,964
A calendar app on your phone. A drive
mapped on your computer. A backup script.
24
00:01:19,004 --> 00:01:22,745
Each one needs its own password,
and you make those here.
25
00:01:24,027 --> 00:01:29,047
Down in Devices and sessions, give
it a name. Calendar on my phone.
26
00:01:29,087 --> 00:01:31,428
Then create a new app password.
27
00:01:34,075 --> 00:01:37,842
Nextcloud makes a long random
password just for that one app.
28
00:01:37,882 --> 00:01:41,587
For security reasons, this
password will only be shown once.
29
00:01:41,627 --> 00:01:43,397
So paste it into the app now.
30
00:01:43,437 --> 00:01:47,204
And if that phone is ever lost,
you remove this one password,
31
00:01:47,244 --> 00:01:48,805
and nothing else changes.
32
00:01:50,074 --> 00:01:50,764
Close it.
33
00:01:51,948 --> 00:01:56,063
Now the authenticator
itself. Tick Enable TOTP.
34
00:01:57,271 --> 00:02:01,956
Nextcloud shows a QR code. Scan it with
any authenticator app on your phone.
35
00:02:01,996 --> 00:02:05,437
Aegis and Google Authenticator
are two the manual names.
36
00:02:05,477 --> 00:02:09,829
From then on, the app shows a new
six digit code every thirty seconds.
37
00:02:11,094 --> 00:02:15,599
To prove the two are linked, type the
code your app is showing, and verify it.
38
00:02:16,811 --> 00:02:19,473
Two-factor is now on for this account.
39
00:02:20,690 --> 00:02:24,123
Before you go anywhere else,
generate your backup codes.
40
00:02:24,163 --> 00:02:26,582
Nextcloud asks for your password first.
41
00:02:27,789 --> 00:02:29,382
These are your backup codes.
42
00:02:29,422 --> 00:02:33,757
Ten of them, and each one works once,
in place of the code from your phone.
43
00:02:33,797 --> 00:02:38,638
Save or print them now, because you will
not be able to read the codes again later.
44
00:02:39,891 --> 00:02:42,288
Keep them somewhere other than your phone.
45
00:02:42,328 --> 00:02:46,002
A password manager on another
device, or a printout in a drawer.
46
00:02:46,042 --> 00:02:50,336
If the phone that makes your codes is
lost, these are how you get back in.
47
00:02:51,588 --> 00:02:54,494
Nextcloud's own manual
says the same thing.
48
00:02:55,702 --> 00:02:59,696
Do not keep them with your second
factor, such as your mobile phone,
49
00:02:59,736 --> 00:03:04,304
but store them separately, so that losing
one does not mean losing the other.
50
00:03:05,542 --> 00:03:09,677
And if you lose both? The
admin manual has one way back.
51
00:03:11,011 --> 00:03:16,070
An administrator switches it off for you,
with a command run on the server itself.
52
00:03:16,110 --> 00:03:20,214
This can be useful if the user
forgot or lost their second factor.
53
00:03:21,454 --> 00:03:25,570
If you're the only administrator,
that someone is you, at the server,
54
00:03:25,610 --> 00:03:27,799
because the browser won't let you in.
55
00:03:27,839 --> 00:03:30,188
That's why the backup codes come first.
56
00:03:31,432 --> 00:03:35,905
Now, that app password. This is the
address apps use to reach your files.
57
00:03:35,945 --> 00:03:40,273
Here's what it says to an app that
sends your normal account password.
58
00:03:41,481 --> 00:03:44,001
Refused. Password login forbidden.
59
00:03:44,041 --> 00:03:47,313
Two-factor is on, the
app can't give a code,
60
00:03:47,353 --> 00:03:50,590
so Nextcloud won't take
the password alone.
61
00:03:51,832 --> 00:03:55,382
Same address. This time,
the app password we made.
62
00:03:56,590 --> 00:04:00,758
Accepted. That's the address
telling an app it's ready to talk.
63
00:04:01,983 --> 00:04:03,305
So which apps need one?
64
00:04:03,345 --> 00:04:07,037
Some apps send you to a Nextcloud
sign in page in your browser.
65
00:04:07,077 --> 00:04:11,954
Those handle the code themselves, and get
their own app password behind the scenes.
66
00:04:11,994 --> 00:04:16,930
Apps that only ask for a username and password
in a box are the ones you make an app
67
00:04:16,970 --> 00:04:17,740
password for.
68
00:04:19,013 --> 00:04:24,038
Now sign out, and back in, to
see the second step for yourself.
69
00:04:25,246 --> 00:04:28,814
Sign in the usual way. Your
username, then your password.
70
00:04:28,854 --> 00:04:32,083
Up to this point, nothing
is different from before.
71
00:04:34,112 --> 00:04:39,552
And now Nextcloud asks for the code from
your app. Underneath, use backup code.
72
00:04:39,592 --> 00:04:42,298
That's the door your backup codes open.
73
00:04:43,540 --> 00:04:45,520
Type the code, and you're in.
74
00:04:49,006 --> 00:04:52,301
If you run this server, you
can go one step further.
75
00:04:52,341 --> 00:04:54,522
Administration settings, Security.
76
00:04:55,734 --> 00:05:00,027
Two-factor authentication can be enforced
for all accounts and specific groups.
77
00:05:01,247 --> 00:05:04,984
Switch on enforce two-factor
authentication, and save.
78
00:05:05,024 --> 00:05:09,641
Nextcloud asks for your password
once more before it changes this.
79
00:05:10,848 --> 00:05:13,243
Left like this, it applies to everyone.
80
00:05:13,283 --> 00:05:17,154
These two boxes limit it to some
groups, or leave a group out.
81
00:05:18,386 --> 00:05:22,010
The page warns that people without
it set up will be unable to log in.
82
00:05:22,050 --> 00:05:24,144
Here's what that looks like in practice.
83
00:05:27,515 --> 00:05:31,862
Dana has an account on this server,
and never set up two-factor.
84
00:05:35,863 --> 00:05:38,845
She isn't locked out.
She's stopped here instead.
85
00:05:38,885 --> 00:05:41,744
Enhanced security is
enforced for your account.
86
00:05:41,784 --> 00:05:45,237
She sets up an authenticator
now, or she doesn't get in.
87
00:05:47,080 --> 00:05:51,895
So, two-factor in Nextcloud. Make app
passwords for the apps that use your password.
88
00:05:51,935 --> 00:05:54,900
Turn on the authenticator
in your security settings.
89
00:05:54,940 --> 00:05:58,021
Save the backup codes somewhere
other than your phone.
90
00:05:58,061 --> 00:06:00,969
And if you run the server,
require it for everyone.
91
00:06:01,009 --> 00:06:02,067
The full checklist,
92
00:06:02,107 --> 00:06:05,997
with the recovery commands for Docker
and for a plain Linux install,
93
00:06:06,037 --> 00:06:07,655
is on the page linked below.