Obsidian 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Obsidian itself doesn't need an account, and there's no two-factor step for opening the app. Two-factor authentication (2FA) protects your Obsidian account, the one you use for Obsidian Sync, Obsidian Publish and license purchases (Obsidian, Obsidian). It's optional. The only method Obsidian documents is an authenticator app, backed up by recovery codes (Obsidian).
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Obsidian steps come from Obsidian Help and Obsidian's changelog, linked below, which we read on October 19, 2026. We haven't tested them on an Obsidian account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
You turn it on in a web browser, on Obsidian's website. Obsidian's help describes these steps (Obsidian):
- Log in to your account at obsidian.md/account/profile.
- In the Profile section, go to 2-factor authentication and select Enable.
- A popup offers a QR code or a setup key. In Novaz, tap +, then Scan QR code, and point the camera at the code. If you're using Safari on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- To use the setup key, tap +, then Enter key manually, and fill in Service (Obsidian), Account (optional) and Setup key. See What is a 2FA setup key?
- Type the six-digit code from Novaz in the popup's third step, below the QR code and setup key.
- Enter your current Obsidian password and select Complete set up.
- A confirmation window shows your recovery codes. Download them before you close it.
Obsidian's help doesn't say how often its codes change. Scanning the QR code is the safer choice, because the QR code carries those settings. A key typed by hand always gets 6 digits every 30 seconds.
If you also keep a copy of the QR code or setup key, Obsidian strongly recommends an encrypted, password-protected place for it.
Keep your recovery codes
Each recovery code works once, in place of the six-digit code from your app (Obsidian). If that phone is gone and you have no up-to-date Novaz backup, these codes are your way back in. Keep them in a password manager or on paper.
If you turned on 2FA before Obsidian added recovery codes, or want a fresh set, select Refresh recovery codes next to 2-factor authentication in your account. Enter your password and your 6-digit authenticator code, then choose Copy recovery codes or Download recovery codes (obsidian-recovery-codes.txt) and select Got it (Obsidian). The help doesn't say whether the old set stops working. See 2FA backup codes.
When Obsidian asks for a code
- On obsidian.md, when you log in to your account.
- In the Obsidian app, when you first log in to your account there to use Sync or Publish (Obsidian). Setting up Sync on a new device includes this step (Obsidian).
- In Obsidian Headless, the command-line client:
ob loginasks for the code by itself, or you can pass it with--mfa(Obsidian).
Devices that are already logged in stay logged in: "Enabling 2FA does not log you out everywhere" (Obsidian). To make every device log in again with a code, log out from your account page.
If the website never asks for a code after you log out and back in, the help points to your browser cache and suggests a private window.
If Obsidian rejects your code
Obsidian's help doesn't cover rejected codes. Check two things:
- The app version. 2FA login needs Obsidian 1.4.5 or later (Obsidian), and 1.6.3 fixed a bug that blocked 2FA logins in the app (Obsidian).
- Your iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
Other causes are in Authenticator code not working?
Changing phones
Obsidian's help doesn't describe moving to a new phone, but it says every new setup gets a new QR code and setup key (Obsidian). So turn 2FA off with the old phone, then turn it on again with the new one. Turning it off needs a current code, so do it before you give up the old iPhone. With a Novaz iCloud backup or backup file, you can instead restore Obsidian on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Log in with one of your recovery codes instead of the six-digit code. If you've lost both your authenticator and your recovery codes, email support@obsidian.md (Obsidian). Obsidian handles account questions by email (Obsidian). The help doesn't say what proof support asks for or how long it takes.
More in Lost the phone with your authenticator app?
Turning 2FA off
In a browser, go to Profile, then 2-factor authentication, and select Disable. Enter your Obsidian password and the current six-digit code, then select Disable 2FA. When it's off, the setting shows an Enable button again (Obsidian). In Novaz, open the Obsidian entry and tap Remove account.
