What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To enable two-factor authentication (2FA) in Nextcloud, an administrator must first activate at least one 2FA provider. Users can then open Personal Settings → Second-factor Auth, enroll an authenticator app by scanning a QR code, verify a time-based code, and generate one-time backup codes. Administrators can also require 2FA for every account or only for selected groups from Administration Settings → Security.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers administrator setup, TOTP enrollment, backup-code recovery, group enforcement, a physical U2F-key option, and the occ commands used when a provider or account becomes stuck.
As an Amazon Associate I earn from qualifying purchases.
How Nextcloud 2FA works
Nextcloud adds a second proof of identity after the normal password. The exact second step depends on the provider an administrator enables. The most common path is time-based one-time passwords (TOTP): an authenticator app holds a shared secret and displays a short code that changes every 30 seconds. During sign-in, Nextcloud checks the code as well as the password.
At least one provider must be enabled by an administrator before any user can configure 2FA. Backup codes are a built-in provider and are always enabled. App-based TOTP, notification-based authentication, and a physical U2F key are separate choices. 2FA is optional by default; enforcement is a separate administrator setting.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before you turn it on
Confirm these conditions before changing settings:
- You have administrator access to the Nextcloud web interface. Only an administrator can enable provider apps or enforce 2FA for groups.
- You can reach Apps → Disabled apps and Administration Settings → Security.
- Each user enrolling TOTP has an RFC 6238-compatible authenticator app. The Nextcloud manual gives Aegis and Google Authenticator as examples.
- Users have a safe place to store recovery codes that is separate from the phone or security key used for daily authentication.
- If you intend to use a physical key, check that the browser and the server version support the relevant U2F flow before buying or deploying keys.
Plan recovery before enforcement. Requiring a second factor for an account that has no enrolled device or backup code can turn a routine login into an administrator-assisted recovery.
Administrator: enable a 2FA provider
The administrator must activate at least one provider. For app-generated codes, enable the official TOTP provider:
- Sign in with an administrator account.
- Open Apps in the Nextcloud navigation.
- Select Disabled apps.
- Find Two-Factor TOTP Provider and choose Enable.
- Allow the app to finish enabling, then return to the account or security settings and confirm that second-factor options are available.
Nextcloud also documents a notification provider. Its second step depends on an already logged-in device receiving or approving a notification, so it is not interchangeable with an authenticator app when the user has lost access to that device. Enable only providers you can support and recover.
Backup codes do not require a separate app installation: the backup-code provider is built in and remains enabled. Users still need to generate their personal codes from Second-factor Auth.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
User: enroll an authenticator app (TOTP)
Once an administrator has enabled the TOTP provider, each user enrolls their own device. The process binds the authenticator app to the Nextcloud account; enabling the provider alone does not complete enrollment.
- Sign in to Nextcloud and open Personal Settings.
- Find Second-factor Auth in the settings navigation.
- Choose the TOTP or authenticator-app option.
- Nextcloud displays a secret and a QR code. Open the authenticator app, choose its option to add an account, and scan the QR code. If scanning is not possible, enter the displayed secret manually.
- Read the current six-digit code in the authenticator app and enter it in Nextcloud to verify enrollment.
- Save or confirm the setting. The code rotates every 30 seconds, so enter the code that is currently displayed rather than one that has just expired.
- Sign out and sign back in. After the password, Nextcloud should request the time-based code.
Use an authenticator that implements RFC 6238. Aegis and Google Authenticator are examples named in the Nextcloud user documentation; other compatible apps can work, but their backup and migration features differ.
Recommended Free Tools
If the QR code cannot be scanned
- Use the manual secret shown beside the QR code, taking care to distinguish similar characters.
- Make sure the phone’s date and time are set automatically. TOTP validation depends on both devices having sufficiently accurate clocks.
- Wait for a fresh 30-second code and submit it promptly. Repeatedly submitting an expired value can make a correct setup appear broken.
- Do not share the QR code or secret. Anyone who obtains it can generate the same TOTP codes.
Generate and protect backup codes
Nextcloud’s user manual says users should always generate backup codes for 2FA. In Personal Settings → Second-factor Auth, select Generate backup codes. Nextcloud creates ten one-time codes.
Store the codes in a secure location that is separate from the phone, tablet, or hardware key used as the primary factor. A printed copy in a protected place or a separately secured password manager entry can provide a recovery path when the primary device is lost. Treat every code like a password: do not post it in tickets, chat, screenshots, or shared notes.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Each code is consumed after one successful use. After using a recovery code, generate a new set when you regain access and invalidate or destroy the old list. Generating a fresh list replaces the previous recovery list, so keep only the current set.
Require 2FA for everyone or selected groups
Enabling a provider makes 2FA available; it does not force every account to use it. To enforce it:
- Sign in as an administrator.
- Open Administration Settings.
- Select Security.
- Locate the two-factor-authentication enforcement controls.
- Choose whether the requirement applies to all users or to selected groups.
- If the interface offers exclusions, configure them deliberately and save the setting.
Nextcloud supports global enforcement and group-based enforcement. If a user is both selected and excluded, the selection takes precedence. Record which groups are covered before saving, especially when nested or overlapping group memberships are used in your organization.
Before enforcing globally, have test accounts enroll and complete a fresh login. Confirm that service accounts, integrations, and emergency administrator accounts have an appropriate factor or an explicitly planned recovery procedure. An exclusion is not a substitute for a recovery plan: a user who is selected for enforcement wins if both rules apply.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Compare the available second-factor choices
| Method | What the user presents | Practical strengths | Important dependency |
|---|---|---|---|
| TOTP authenticator app | A code that changes every 30 seconds | Works offline after enrollment; apps are widely available; the secret can be migrated if the app supports export | The user must protect the enrolled phone and keep its clock accurate |
| Notification provider | An approval or notification on an already logged-in device | Can be convenient when the approved device is nearby | Depends on access to that existing logged-in device and its notification path |
| U2F security key | A physical token inserted or connected during sign-in | Provides a possession-based factor without typing rotating codes; a spare key can be kept for recovery | Requires a compatible browser and server implementation, plus the physical key and its setup cost |
| Backup codes | A single-use recovery code | Works when the normal device is unavailable; easy to store offline | They are emergency recovery credentials, not a primary daily factor, and each code works only once |
Choose a primary method that users can reliably carry and recover. Keep backup codes separate regardless of which primary provider is selected.
Use a physical U2F key
The Nextcloud user manual lists Nitrokey FIDO U2F as a supported second factor. The general product category is a FIDO U2F security key: a small physical token that the user presents during authentication instead of reading a TOTP code.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Check the Nextcloud server version, browser support, and the provider documentation for the exact U2F flow in your deployment.
- Enable the corresponding U2F provider if it is not already available.
- In Personal Settings → Second-factor Auth, choose the hardware-key enrollment option.
- Insert or connect the key when prompted and perform the key’s touch or confirmation action.
- Complete a test sign-in in a second browser session before relying on the key as the only primary factor.
- Generate backup codes and, where policy allows, register a spare key stored separately.
Compatibility is version- and browser-dependent. Verify it before purchase or before enforcing the key for a group; the manual’s listing of a supported key does not guarantee that every browser, server release, or deployment configuration behaves identically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if an authenticator or key is lost
You still have a backup code
- At the 2FA prompt, choose the recovery or backup-code option.
- Enter one unused code exactly as generated.
- After signing in, open Personal Settings → Second-factor Auth.
- Remove the lost factor if the interface provides that control, enroll a replacement authenticator or key, and generate a new backup-code list.
- Revoke or destroy the old list so a found device or copied code cannot remain usable.
You have no backup code but can contact an administrator
An administrator can disable a provider for one user with the documented command:
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
sudo -E -u www-data php occ twofactorauth:disable <uid> <provider_id>
Run it from the Nextcloud installation directory containing occ, substituting the affected user’s UID and the provider ID. The user can then sign in and enroll a replacement factor. Because provider IDs differ by installation, identify the exact provider before running the command.
You are unsure which providers are active
Check the user’s current provider state with:
sudo -E -u www-data php occ twofactorauth:state <uid>
This helps distinguish an unenrolled account from one that still has an active, inaccessible provider.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFix stale or removed providers
Disabling or removing a provider app does not necessarily erase every user’s association with it. Nextcloud can continue to regard that provider as active for users. If the provider will not be enabled again, an administrator can remove stale associations with:
sudo -E -u www-data php occ twofactorauth:cleanup <provider_id>
The administration manual warns that cleanup is irreversible. Use it only when you are certain the provider will not return; otherwise, restore or re-enable the provider and resolve individual accounts instead. Confirm the provider ID and take an administrative backup according to your normal change procedure before executing an irreversible cleanup.
Troubleshoot common enrollment and login failures
“Second-factor Auth” is missing
- Ask an administrator to verify that Two-Factor TOTP Provider is enabled under Apps → Disabled apps.
- Confirm that you are looking in Personal Settings, not the administrator’s security page.
- Sign out and back in after the provider is enabled, then reload the settings page.
The code is always rejected
- Check the phone’s automatic date, time, and time-zone settings.
- Wait for the next 30-second value and submit it before it changes.
- Confirm that the account in the authenticator app corresponds to the intended Nextcloud server and user.
- If the problem began after reinstalling the app, use a backup code or ask an administrator to disable the affected provider so you can enroll again.
Enforcement blocks a user who was meant to be exempt
Review group membership and the selected/excluded rules under Administration Settings → Security. A user who is both selected and excluded is treated as selected, so remove the selection or change the applicable group rather than relying on the exclusion.
A provider was removed and users cannot sign in
First inspect an affected account with twofactorauth:state. If the provider is permanently retired, use twofactorauth:cleanup only after confirming that it will not be re-enabled. If only one user is affected, the administrator can use twofactorauth:disable for that user’s provider and have the user enroll again.
Operational checklist for administrators
- Enable at least one provider before telling users to enroll.
- Test enrollment and a complete sign-in with a non-administrator account.
- Require every user to generate and securely store backup codes.
- Document which groups are enforced and review overlapping memberships.
- Keep an emergency administrative recovery procedure that does not depend on the same lost device.
- When changing providers, check active associations before disabling or uninstalling anything.
- Use the state, disable, and cleanup commands with the correct UID or provider ID; cleanup cannot be undone.
- For hardware keys, verify browser and server compatibility and maintain a replacement or backup-code path.
What Nextcloud does not publish about 2FA performance
The cited Nextcloud manuals explain configuration, recovery, and provider behavior, but they do not publish a validated percentage for attacks blocked by this feature or another quantitative security-performance benchmark. The practical benefit therefore depends on correct enrollment, protection of the secret or physical key, reliable recovery storage, and sensible enforcement—not on an advertised blocking rate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
