Can I use Dropbox 2-factor authentication without a phone?

Yes. Dropbox’s help says any app that supports the Time-based One-Time Password (TOTP) protocol should work, and it only checks the six-digit code. The Authenticator extension reads the QR code straight off dropbox.com and generates the codes in Chrome on your computer.

What if I lose access to my authenticator?

On the sign-in screen click “Having trouble getting a code?” and enter one of your emergency backup codes, or text a code to your backup phone if you added one. A computer signed in to the Dropbox desktop app is a trusted device and can open dropbox.com without a code. Once you are in, set the authenticator up again — and keep the extension’s automatic backups on so a reinstall does not put you here.

Why does Dropbox say my code is invalid?

Usually the computer clock is off by a minute or more — Dropbox notes that authenticator apps depend on the device’s time. Turn on automatic date and time and try the next code. If it still fails, check you are copying the code of the right Dropbox account, or remove it from the extension and set 2-factor authentication up again.

Why doesn’t Dropbox ask me for a code?

Because you are on a trusted device — a browser you signed in on before, or a computer with the Dropbox desktop app. To see the prompt again, clear the browser’s cookies or click “Revoke All” next to “Trusted Devices” under Settings → Security.

Dropbox Authenticator App — Turn On 2-Factor Authentication

A Dropbox account often holds everything at once — tax returns, ID scans, contracts, family photos — and folders shared with other people. Whoever signs in with a stolen password can download or delete all of it. With 2-factor authentication on, Dropbox also asks for the six-digit code from your authenticator, and a leaked password does not come with it.

Turn on 2-factor authentication at Dropbox

Dropbox sets this up only on dropbox.com, not in its desktop or mobile apps. If the “Security” tab says “Managed by single sign-on”, your team admin handles sign-in through a central identity provider, and Dropbox’s own 2-factor authentication is not needed.

Sign in at dropbox.com on your computer and click your avatar — your profile picture or initials, top right or bottom left depending on your plan.
Click “Settings”, then open the “Security” tab.
Toggle “2-factor authentication” to “On”, re-enter your password and click “Submit”.
Select “Use an authenticator app”.
Dropbox shows a QR code. Leave it on the screen and add it to the extension as described below — or copy the “Secret key” instead — then click “Next”, enter the code from the extension and click “Next” again.

Dropbox’s own instructions

Add Dropbox to Authenticator

Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
Leave the Dropbox page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
Go back to Dropbox and type the current code into the confirmation field. If it is about to expire, wait for the next one.
Dropbox confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.

No QR code, or it will not scan? Look for the option to enter a key manually on Dropbox’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.

Get 2FA Authenticator for Chrome — free

Save your 10 Dropbox backup codes

Next Dropbox offers to add a secondary phone number — optional, “Skip for now” is fine — and then shows your recovery codes: ten eight-digit codes, each good once. Store them somewhere other than this computer, check “I’ve stored my recovery codes in a safe place” and click “Finish”. You can see them again under Settings → Security → “Show” next to “Recovery codes”. Turning 2-factor authentication off and on again resets them, so save the new set each time.

The code is not accepted?

Almost always the computer’s clock. The codes are calculated from the current time, so a clock that is a minute off produces codes that look right and are refused. Turn on automatic date and time in your system settings — step-by-step for Windows, macOS and Linux.

If the clock is right, check the key itself: paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.

Questions

Can I use Dropbox 2-factor authentication without a phone?: Yes. Dropbox’s help says any app that supports the Time-based One-Time Password (TOTP) protocol should work, and it only checks the six-digit code. The Authenticator extension reads the QR code straight off dropbox.com and generates the codes in Chrome on your computer.
What if I lose access to my authenticator?: On the sign-in screen click “Having trouble getting a code?” and enter one of your emergency backup codes, or text a code to your backup phone if you added one. A computer signed in to the Dropbox desktop app is a trusted device and can open dropbox.com without a code. Once you are in, set the authenticator up again — and keep the extension’s automatic backups on so a reinstall does not put you here.
Why does Dropbox say my code is invalid?: Usually the computer clock is off by a minute or more — Dropbox notes that authenticator apps depend on the device’s time. Turn on automatic date and time and try the next code. If it still fails, check you are copying the code of the right Dropbox account, or remove it from the extension and set 2-factor authentication up again.
Why doesn’t Dropbox ask me for a code?: Because you are on a trusted device — a browser you signed in on before, or a computer with the Dropbox desktop app. To see the prompt again, clear the browser’s cookies or click “Revoke All” next to “Trusted Devices” under Settings → Security.

Your codes, one click from the login page

Authenticator keeps your 2FA codes in the browser, on your device only — free to use, open source, no account and no phone needed. Local backups and optional password protection come built in.