Your copy of Minecraft — Java or Bedrock — belongs to the Microsoft account you sign in with, and so do your Realms, Marketplace purchases and Minecoins. Stolen Minecraft accounts get resold, and bringing two-factor authentication was a main reason Mojang moved Java players from Mojang accounts to Microsoft accounts. With two-step verification on, a password alone no longer signs anyone in — to Minecraft, or to Outlook, Xbox and everything else on that account.
Turn on two-step verification for the Microsoft account you play with
With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on.
- Sign in at account.microsoft.com/security on your computer with the Microsoft account you play Minecraft with.
- Click “Manage how I sign in” to see the ways you prove who you are.
- Click “Add a new way to sign in or verify” and choose “Use an app”.
- Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”.
- Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension.
- Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen.
Add Minecraft to Authenticator
- Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
- Leave the Microsoft account page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
- The account appears in the list with a six-digit code that changes every 30 seconds. Rename it to Minecraft if you like — the name is only for you.
- Go back to the Microsoft page and type the current code into the confirmation field. If it is about to expire, wait for the next one.
- Microsoft confirms the app is added. From now on, when signing in to Minecraft asks for a code, click the extension icon and copy it.
No QR code, or it will not scan? Click “I can't scan the bar code” on Microsoft’s setup screen, copy the code, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.
Get 2FA Authenticator for Chrome — freeGenerate your Microsoft recovery code
On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect.
The code is not accepted?
Most often the QR code changed: the website makes a new one each time its setup page is reloaded or opened again, so the account you added first no longer matches. Start the setup again, add the QR code that is on the screen now and type its code in straight away. Two entries for the same website? Use the newest. Other reasons: why codes are refused.
Typed the key in by hand? Paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.
Questions
- Does Minecraft have its own 2FA setting?
- No. Minecraft Java and Bedrock both sign in with a Microsoft account, and two-step verification is set on that account at account.microsoft.com. One setting protects both editions — and every other Microsoft service you use with the same account.
- Do I have to use Microsoft Authenticator?
- No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page — no phone needed.
- What if I lose access to my authenticator?
- Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups.
- Why can’t I add a phone number for text message codes?
- Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so the option may not appear at all. An authenticator app, a passkey or a backup email address are what it offers instead.
Your codes, one click from the login page
Authenticator keeps your 2FA codes in the browser, on your device only — free to use, open source, no account and no phone needed. Local backups and optional password protection come built in.
Get 2FA Authenticator for Chrome — free