Cognito Forms 2FA: how to set up an authenticator app

Your Cognito Forms account is where you build forms and manage entries for one or more organizations. Its two-factor authentication (2FA) has a twist. You set up an authenticator app, and you also give Cognito Forms a second email address. That backup email is your way back in if you lose the app. Cognito Forms doesn't document backup codes, and it doesn't offer text-message codes (Cognito Forms).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Cognito Forms steps come from Cognito Forms' own support articles and product page, linked below, which we read on October 21, 2026. We haven't tested them on a Cognito Forms account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is 2FA required?

For your own account it's optional, though Cognito Forms encourages everyone to turn it on (Cognito Forms). An organization on the Enterprise plan can make it mandatory. An administrator does that under Settings > Users & Authentication with the toggle Require two-factor authentication for all users in your organization. Members without 2FA must set it up at their next sign-in, and the Users section shows who has it (Cognito Forms). If you turn 2FA off later, you lose access to that organization until you turn it back on (Cognito Forms).

Before you start: you need a password

Setup asks for your password. If you signed up with Google, Facebook or Microsoft and have none, create one in the profile section of My Account first (Cognito Forms).

You also need a second email address, different from your account's main one.

Turn on 2FA with an authenticator app

These steps follow Cognito Forms' account settings article (Cognito Forms):

1. Select your profile picture in the top right corner, then My Account.
2. Turn on the toggle for Two-Factor Authentication.
3. Enter your password.
4. Cognito Forms shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're doing this on your iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, select Can't scan the QR code?. Cognito Forms then shows a code to type into your app by hand, which is the setup key. In Novaz, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
6. Type the six-digit code from Novaz, and enter your backup email address.

Cognito Forms emails you to confirm. Its pages don't say how often the codes change, so scanning the QR code is the safer choice: it tells Novaz the code settings.

When Cognito Forms asks for a code

Once 2FA is on, you need your password and a code from the app to sign in. On the sign-in screen, Remember Me keeps you signed in for 30 days. If you sign in with Google, Facebook or Microsoft, the option is called Remember this Device (Cognito Forms).

If Cognito Forms rejects your code

Cognito Forms points to the clock: codes are time-based, so your phone's time has to match the official time (Cognito Forms). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

Too many attempts lock you out for a while, and Cognito Forms suggests contacting its support team if sign-in keeps failing. More causes are in Authenticator code not working?

Changing phones

Cognito Forms lets you move 2FA to a new device yourself while you can still sign in. Go to My Account, select Change Settings next to the Two-Factor Authentication toggle, enter your password and select Next. Select Change to scan a new QR code with the new phone, then Save (Cognito Forms, Cognito Forms). The same screen updates your backup email. One article writes the link as Change settings, so the capitalization may differ.

If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. Otherwise, do this while the old phone still works, and scan the new QR code with Novaz on the new iPhone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use the backup email. On the sign-in screen, select the link under Can't access your authenticator? and Cognito Forms sends a code to your backup address (Cognito Forms). Once you're in, use Change Settings to connect a new app.

If the phone is gone and you have no Novaz backup to restore, that backup inbox is your safety net. Keep it current. Cognito Forms doesn't say what happens if you lose both the app and the backup email. Its only documented route for sign-in trouble is the support request form, with no word on proof or timing. More in Lost the phone with your authenticator app?

Turning 2FA off

In My Account, set the Two-Factor Authentication toggle to Disabled, enter your password and select Disable. If you turn it on again later, you go through the full setup and add a new entry to your app (Cognito Forms). Remove the old one in Novaz by opening it and tapping Remove account.

Official Cognito Forms help

• Manage Your Cognito Forms Account Settings
• What happens if I lose my authenticator device or phone?
• Does Cognito Forms support two-factor authentication?
• How to Manage SSO & Authentication Settings
• Two-Factor Authentication for Extra Security