iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To enable two-factor authentication (2FA) in Nextcloud, an administrator must first enable at least one 2FA provider. For app-based codes, enable Two-Factor TOTP Provider in Apps → Disabled apps. Each user then opens Personal Settings → Second-factor Auth, scans a QR code with a compatible authenticator, verifies the six-digit time-based code, and generates backup codes. Administrators can leave 2FA optional or require it for everyone or for selected groups under Administration Settings → Security.
What Nextcloud 2FA does and what you need
Two-factor authentication adds a second proof of identity after the password. In a typical Nextcloud login, the password is something you know; a code from an authenticator app, a hardware key, or a backup code supplies the additional factor. This helps when a password is exposed, reused, guessed, or captured by a phishing attempt, although no 2FA method makes a compromised account or device harmless.
Nextcloud supports several provider types. The administrator has to enable at least one provider before users can enroll. The built-in backup-code provider is always enabled, but backup codes are intended for recovery rather than ordinary daily sign-in.
Prerequisites for administrators
- Administrative access to the Nextcloud instance.
- Permission to manage apps and security settings.
- A decision about which provider or providers your organization will support.
- A recovery procedure for users who lose a phone, security key, or backup codes.
Prerequisites for users
- Access to their Nextcloud account after the administrator enables a provider.
- An RFC 6238-compatible authenticator app for TOTP, or a compatible physical security key if that provider is available.
- A safe place to store one-time backup codes separately from the primary second-factor device.
Menu names can differ slightly between Nextcloud releases or themes, but the administration and personal-settings paths below use the labels in the current manuals.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the provider that fits your users
| Provider | How it works | Best use | Important limitation |
|---|---|---|---|
| TOTP/authenticator app | The app calculates a time-based code from a shared secret. The code rotates every 30 seconds. | General-purpose 2FA that works without a mobile signal once enrolled. | Users must protect the phone and plan how to migrate the secret when replacing it. |
| Notification-based 2FA | A sign-in approval is sent to an already logged-in or registered device. | Users who want an approval prompt instead of manually entering a code. | It depends on access to the notification device and its account session. |
| U2F hardware key | A physical key proves possession during sign-in. | People who prefer a dedicated token or do not want codes copied from a phone. | There is a purchase and setup cost, and browser/server compatibility must be checked. |
| Backup codes | Each code is accepted once as an emergency replacement for the normal factor. | Recovery after a lost phone, unavailable key, or travel without the usual device. | They are finite, reusable only once, and should not be treated as the primary daily factor. |
For most installations, TOTP is the simplest starting point. A hardware key can be appropriate for administrators or users who want a physical factor. Notification-based authentication is convenient only when the user can reliably reach the device that receives the prompt.
Enable a 2FA provider as an administrator
Users cannot configure 2FA until an administrator enables a provider. The TOTP provider is the usual choice for authenticator-app codes.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Sign in with an administrator account.
- Open Apps from the main Nextcloud menu.
- Open Disabled apps.
- Find Two-Factor TOTP Provider and select Enable.
- Confirm that the app now appears as enabled before asking users to enroll.
Nextcloud also documents a notification provider. Enable it only if the notification method is available and supportable in your deployment. The backup-code provider is built in and is always enabled; it does not replace the need to enable a normal second-factor provider.
Enable more than one provider when appropriate
Enabling multiple providers can give users a primary factor and a fallback. For example, an organization might offer TOTP and a U2F key while relying on backup codes for emergencies. Every additional provider creates another enrollment and support path, so publish clear instructions about which factor is preferred and how recovery works.
Enroll a user with a TOTP authenticator
After the administrator enables the TOTP provider, each user enrolls from their own account. The QR code contains the secret that links the authenticator to the Nextcloud account; treat it as sensitive as a password during setup.
- Sign in to Nextcloud with your normal username and password.
- Open Personal Settings.
- Find Second-factor Auth.
- Choose the TOTP or authenticator-app option.
- Display the QR code (or the text secret if your app requires manual entry).
- Open an RFC 6238-compatible authenticator, such as Aegis or Google Authenticator, and scan the QR code. If scanning is not possible, enter the displayed secret manually.
- Wait for the app to generate the current code and enter it in Nextcloud.
- Submit the code to verify the enrollment.
TOTP codes change every 30 seconds. Enter the code shown for the current time; if it is close to expiring, wait for the next code rather than repeatedly submitting an old one. The phone’s clock should be set automatically, because a significant time difference can make otherwise correct codes fail.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Confirm that enrollment works
- Sign out of Nextcloud after the verification succeeds.
- Sign in again with your password.
- When Nextcloud asks for the second factor, enter the current code from the authenticator.
- Confirm that the account reaches the normal Nextcloud interface.
Do this test while you still have the setup screen, the authenticator, and the recovery information available. Do not remove the old factor from a device until a new factor has been tested.
Generate and protect backup codes
Nextcloud’s user manual says you should always generate backup codes for 2FA. In Personal Settings → Second-factor Auth, select Generate backup codes. Nextcloud generates ten one-time codes.
- Open Personal Settings → Second-factor Auth.
- Select Generate backup codes.
- Save or print the complete list immediately.
- Store it in a secure location separate from the phone or hardware key.
- Keep track of which codes have been used; each code works only once.
Storing the codes separately matters. If the phone is lost, a copy stored only on that phone is lost with it. Conversely, leaving the list beside the phone removes much of the benefit of having two independent recovery paths. Treat the list as a set of emergency credentials: do not paste it into tickets, chat messages, screenshots shared with support, or an unsecured notes file.
Using a backup code
At the second-factor prompt, enter one unused backup code in place of the normal TOTP code or other factor. The code is consumed after successful use. Once the remaining list is short, generate a new set from Second-factor Auth and protect the replacement list; do not assume an old list can be reused.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Enforce 2FA for everyone or selected groups
2FA is optional by default. An administrator can require it globally or for selected groups from Administration Settings → Security.
Require 2FA for all users
- Sign in as an administrator.
- Open Administration Settings.
- Select Security.
- Find the two-factor authentication enforcement controls.
- Enable the requirement for all users.
- Configure any documented exclusions, if your deployment needs them.
- Save the setting and communicate the enrollment deadline and recovery process.
A global requirement is appropriate when every account can use a supported provider and you have a recovery procedure for locked-out users. Test the policy with a non-administrator account before applying it to a large installation.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Require 2FA for selected groups
- Open Administration Settings → Security.
- Choose the control for enforcing 2FA for selected groups.
- Add the groups whose members must enroll.
- Add exclusions only for the accounts that genuinely need them.
- Save the configuration and verify the result with a test account in each relevant group.
Nextcloud’s documented precedence rule is important: if a user is both selected and excluded, selection takes precedence. Check overlapping group membership before assuming an exclusion will exempt an account.
Plan enforcement before switching it on
- Tell users which authenticator or key types are supported.
- Give users time to enroll and generate backup codes.
- Keep at least one administrator recovery route available.
- Document who can run recovery commands and how identity will be verified.
- Test the policy after upgrades, provider changes, and group-directory synchronization.
Use a physical U2F security key
Nextcloud’s user manual lists Nitrokey FIDO U2F as a supported second factor. A compatible FIDO U2F security key is a possession-based option: the user inserts or taps the key and confirms the operation when prompted instead of reading a rotating code.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBefore buying or deploying a key, verify compatibility with the browser, operating system, Nextcloud version, and enabled provider. Support can depend on the exact browser and server configuration, so a key that works with one environment should not automatically be assumed to work with another.
Operational practices for keys
- Enroll a spare key where the deployment and provider support more than one key.
- Keep the spare in a controlled, separate location.
- Record which account each key is registered to without recording private secrets.
- Test sign-in and recovery before making the key mandatory.
- Remove a lost key’s registration promptly when the provider and account workflow allow it.
A hardware key reduces dependence on a phone, but it does not remove the need for backup codes or an administrative recovery plan. Losing the only registered key can be as disruptive as losing the only authenticator phone.
Troubleshoot common enrollment and sign-in failures
The Second-factor Auth section is missing
- Confirm that the administrator enabled Two-Factor TOTP Provider under Apps → Disabled apps.
- Sign out and back in, or reload the personal-settings page, after the provider is enabled.
- Ask the administrator to confirm that the account is not using a provider unavailable to the current deployment.
The code is rejected
- Wait for a fresh 30-second code and submit it before it expires.
- Set the phone’s date and time to automatic network time.
- Check that the correct Nextcloud account entry is being used in the authenticator.
- If the QR code was entered manually, compare the secret carefully and enroll again if a character was mistyped.
- Confirm that the server and phone clocks are reasonably synchronized.
The QR code was exposed
The QR code represents the TOTP secret. If another person photographed or copied it, treat the enrollment as compromised: remove or reset that factor using the account’s available controls, enroll a new secret, verify the new code, and regenerate backup codes if there is any chance they were also exposed.
A user lost the phone or key but has a backup code
- Sign in with the password and one unused backup code.
- Open Personal Settings → Second-factor Auth.
- Enroll the replacement authenticator or key.
- Generate a fresh set of ten backup codes and store them separately.
- Remove the lost factor if the provider exposes a removal control.
A user has no factor and no backup code
An administrator must follow the organization’s identity-verification procedure before changing the account’s 2FA state. Do not disable 2FA merely because someone asks by email or chat; verify ownership through an independent channel.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Nextcloud documents a provider-specific command for an individual lockout:
sudo -E -u www-data php occ twofactorauth:disable <uid> <provider_id>After the provider is disabled for that user, the user can enroll again. The exact user ID and provider ID must be supplied; do not replace them with the display name unless your deployment uses the same value.
Use the documented state command to inspect the current provider state before changing anything:
sudo -E -u www-data php occ twofactorauth:state <uid>Run these commands as the account that owns the Nextcloud files in your installation. Record the change and require immediate re-enrollment and backup-code generation.
A provider was disabled or removed but still appears active
Nextcloud can continue to consider a provider active for users even after the provider is disabled or removed. The administration manual documents this cleanup command:
sudo -E -u www-data php occ twofactorauth:cleanup <provider_id>Cleanup is irreversible. Use it only when the provider will not be enabled again, and confirm the provider ID before running it. If you might restore the provider, resolve the deployment issue without cleanup so existing associations are not destroyed.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Manage 2FA safely after deployment
Separate daily authentication from emergency recovery
Users should use TOTP, a notification, or a hardware key for normal sign-ins. Backup codes should remain sealed or otherwise protected until a real recovery event. This separation makes it easier to recognize when a backup code has been used and when a new list must be generated.
Protect administrators especially carefully
Administrators can change provider settings, enforce policies, and affect other users’ access. Require 2FA for administrator accounts, keep a tested recovery path, and avoid making a single person’s phone or key the only way to regain access to the instance.
Recommended Free Tools
Review changes and group membership
When enforcement is group-based, review membership changes and exclusions as part of normal account administration. Because selected membership takes precedence over exclusion, an account added to a required group can immediately become subject to the policy.
Do not promise a specific attack-blocking rate
The current Nextcloud administration and user manuals describe the providers, setup, and recovery process but do not publish a validated percentage for attacks blocked by this feature. The practical security benefit depends on the factor chosen, how safely secrets and devices are handled, and whether users can be tricked into approving or revealing a second factor.
Which setup should you choose?
- Most users: enable the TOTP provider, enroll an authenticator app, and generate ten backup codes.
- Users who prefer a physical token: verify compatibility and enroll a supported U2F key, while retaining a separate recovery method.
- Organizations with managed devices: consider notification-based authentication only when the notification device and its logged-in session are reliably available.
- High-impact accounts: require 2FA, test recovery before enforcement, and maintain a documented spare-factor or administrator-assisted recovery process.
Final checklist
- An administrator enabled at least one provider.
- Each user enrolled from Personal Settings → Second-factor Auth.
- The TOTP code was verified and a fresh sign-in test succeeded.
- Ten one-time backup codes were generated and stored separately from the factor device.
- Any global or group requirement was configured under Administration Settings → Security.
- Overlapping selected and excluded groups were checked.
- Administrators know how to inspect state and handle an individual lockout.
- Provider cleanup will be used only when the provider will not return.
Frequently Asked Questions
How many backup codes does Nextcloud generate?
Nextcloud generates ten one-time backup codes when you select Generate backup codes in Personal Settings → Second-factor Auth.
How often does a Nextcloud TOTP code change?
The authenticator code changes every 30 seconds.
Can an administrator require 2FA for only one group?
Yes. Use Administration Settings → Security to enforce 2FA for selected groups. If a user is both selected and excluded, selection takes precedence.
What should I do before running twofactorauth:cleanup?
Confirm the provider will not be enabled again. The cleanup operation is irreversible and removes stale provider associations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
