ePayslips 2FA: how to set up an authenticator app

ePayslips is the online portal where many UK employers publish payslips, P60s and other pay documents for their staff. You don't sign up for it yourself: your employer (or its payroll bureau) sends you sign-up instructions, and the portal often carries your employer's branding rather than the ePayslips name. The service now belongs to IRIS and is sold as "ePayslips by IRIS" (IRIS).

ePayslips calls its two-step sign-in multi-factor authentication (MFA). It works with ordinary authenticator apps: its own announcement names Google Authenticator, Duo, Authy and LastPass as examples (ePayslips, archived). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the ePayslips facts come from ePayslips' own website and from IRIS's page about it, linked below, which we read on October 24, 2026. The old epayslips.co.uk pages now redirect to IRIS, so we read them in archived copies on web.archive.org (the newest from January 2025). We haven't tested anything on an ePayslips account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

What ePayslips documents, and what it doesn't

ePayslips' public pages are short on detail. Here is what they do say:

• MFA protects the employee's account with a second check, a code from an app, on top of the password (ePayslips, archived).
• You can turn it on the first time you open the portal, or later from the My account page (same source).
• MFA is for the web app. The ePayslips mobile app offers fingerprint and face sign-in instead (ePayslips, archived).
• Employers can also connect the portal to their own sign-in system with single sign-on (SAML 2.0) (same source). If yours has, you may never see an ePayslips sign-in screen, and two-step sign-in is handled by your employer's system.

The pages don't show the setup screens, don't say whether a QR code or a text key is shown, don't mention backup codes, and don't say whether an employer can make MFA compulsory.

Turn on 2FA with an authenticator app

1. Sign in to your employer's ePayslips portal in a web browser. The standard sign-in page is login.epayslips.co.uk, but your employer may give you a different address.
2. If the portal offers MFA during your first sign-in, follow it from there. Otherwise open the My account page and look for the multi-factor authentication option.
3. If you see a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the iPhone you're using, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. If you only get a text key, tap +, then Enter key manually, and fill in Service (for example, "ePayslips"), Account if you like, and Setup key. See What is a 2FA setup key?
5. Type the code Novaz shows into the portal to finish.

ePayslips doesn't publish its code settings, so scan the QR code if one is offered. A QR code tells Novaz the exact settings; a key typed by hand always gets 6-digit codes every 30 seconds.

Backup codes

ePayslips' pages say nothing about backup or recovery codes. If the setup screen gives you any, save them somewhere other than your phone, such as a password manager or on paper. Unless you back up Novaz with iCloud backup or Export to file…, its keys exist only on your iPhone, so those codes would be your way back in if it's lost. More in 2FA backup codes.

If ePayslips rejects your code

ePayslips doesn't publish advice for rejected codes. Most often the iPhone's clock has drifted: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

ePayslips doesn't describe moving MFA to a new phone. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your ePayslips codes keep working. Without one, while you still have the old phone, sign in and look on My account for a way to set the authenticator up again on the new one. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

ePayslips points anyone who can't sign in to its account recovery process. It adds that if you can't complete that, your employer has to sort it out (ePayslips, archived). When we checked, the recovery page at login.epayslips.co.uk still worked: its first step asks for the email address you signed up with (ePayslips). Its FAQ says employees set up their own security so they can reset lost details without the employer, which is why every account needs an email address (ePayslips, archived). Keep that inbox working. ePayslips doesn't say whether recovery resets MFA, what proof it asks for, or how long it takes.

So in practice your employer's payroll or HR team is the route if recovery fails. ePayslips also sends payslip questions to your employer, since it only delivers the documents on the employer's behalf (same source). General steps are in Lost the phone with your authenticator app?

Official ePayslips help

• ePayslips by IRIS
• Multi-factor authentication, the future of security (archived copy)
• ePayslips Data Security (archived copy)
• Help (archived copy)
• ePayslips FAQ (archived copy)
• Account recovery: Finding your account