Bugcrowd 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Bugcrowd has two kinds of accounts. Researchers use theirs to join programs and submit findings. Customers use Crowdcontrol, where organizations run their programs. Both can use an authenticator app, but the settings and rules differ.
For researchers, two-factor authentication (2FA) isn't optional: Bugcrowd makes it mandatory on every researcher account, which also covers any program that asks for 2FA (Bugcrowd). In 2026 Bugcrowd moved researcher sign-in to a new service built on Okta, so older screenshots may show a page that no longer exists (Bugcrowd).
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Bugcrowd steps come from Bugcrowd's own documentation at docs.bugcrowd.com, including the screenshots on those pages, which we read on October 21, 2026. We haven't tested them on a Bugcrowd account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Researcher accounts: the methods you can use
After the move to Okta, the Security methods page offers three kinds of second step (Bugcrowd):
- Okta Verify, Okta's own app.
- Security Key or Biometric Authenticator, such as a hardware key.
- Google Authenticator. Despite the name, Bugcrowd says any compatible time-based (TOTP) app works here, so this is the option for Novaz.
If you set up 2FA before 2026, you'll also see Bugcrowd Legacy OTP. Your existing codes keep working through it, but you can't add new devices to it. If you want it removed, Bugcrowd Support does that (Bugcrowd).
Add an authenticator app as a researcher
- Sign in to Bugcrowd. The researcher sign-in page is now login.hackers.bugcrowd.com, and the old identity.bugcrowd.com address redirects there (Bugcrowd).
- Click your profile picture, then Account settings > Security > Settings > Manage authentication settings. This opens Security methods on the authentication service (Bugcrowd).
- Next to Google Authenticator, click Set up.
- Bugcrowd's documentation stops at this button and doesn't show the next screens. When a QR code appears, open Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you're offered a text key instead, tap +, then Enter key manually in Novaz, and paste it into Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz where the page asks for it.
Bugcrowd suggests enrolling more than one method, so losing one device doesn't lock you out.
Customer accounts in Crowdcontrol
Crowdcontrol's setup page is older and still describes the original screen (Bugcrowd):
- Click your profile picture, then Security.
- On the left, click Two-factor authentication.
- Work through the three numbered steps on the page. Under Configure the app, the screenshot shows a QR code under Scan QR code: and a 16-character key under Manually enter the code below into the app:. Scanning it with Scan QR code in Novaz is easiest.
- Type the code from Novaz in 6-digit OTP code and click Enable 2FA.
That page calls 2FA optional for customers. A separate, newer page says multi-factor authentication is now enforced for everyone in every organization who signs in with a username and password (Bugcrowd). If your organization signs in through SAML single sign-on, your identity provider handles the second step instead, and Crowdcontrol doesn't show a 2FA check mark for you.
When Bugcrowd asks for a code
Both kinds of account ask for a code each time you sign in, along with your username and password. Researchers can answer with any method they've enrolled (Bugcrowd).
Backup codes
Bugcrowd's changelog announced 2FA backup codes for researchers in 2020 and for customers in 2024 (Bugcrowd). The current help pages no longer describe them, and the researcher page now recommends enrolling more than one method as the way to avoid a lockout. If your settings still offer backup codes, save them away from your phone: they get you in if the iPhone is lost and you have no Novaz backup. See 2FA backup codes.
If Bugcrowd rejects your code
Bugcrowd's pages don't cover rejected codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If your researcher account gets locked, Bugcrowd emails an Unlock account link, and the account unlocks itself after an hour anyway (Bugcrowd). More causes are in Authenticator code not working?
New phone or lost phone
If you back up Novaz with iCloud backup or a backup file, you can restore Bugcrowd on the new iPhone. Without a backup, a new phone means adding Bugcrowd again. Researchers can do that themselves while they still have a working method: on Security methods, set up Novaz on the new phone and update your configured methods (Bugcrowd doesn't spell out the steps) (Bugcrowd). For customers, Bugcrowd's page says a new or lost phone means a ticket through the Bugcrowd Support Portal right away (Bugcrowd). See How to transfer your authenticator app to a new iPhone.
If you've lost every enrolled method, contact Bugcrowd Support and ask for a 2FA reset (Bugcrowd). Bugcrowd doesn't say what proof it asks for or how long a reset takes. More in Lost the phone with your authenticator app?
Turning 2FA off
Researchers can't, since 2FA is mandatory; they can only swap methods. The Crowdcontrol page still tells customers to click Disable two-factor authentication under Security > Two-factor authentication, after which Bugcrowd signs them out (Bugcrowd). With MFA now enforced for password sign-ins, that button may no longer be there. If you do turn it off, remove the entry in Novaz with Remove account.
