Plausible Analytics 2FA: how to set up an authenticator app

Your Plausible Analytics account holds your site dashboards, your team and your subscription. Its two-factor authentication (2FA) has one method: a code from an authenticator app, with recovery codes as the fallback. Plausible's help mentions no text-message option (Plausible). 2FA is optional unless a team owner makes it mandatory. We use Authenticator App - Novaz on iPhone below, but any authenticator app works the same way.

How we checked this guide: the Plausible Analytics steps come from Plausible's own documentation and its screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a Plausible account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Plausible describes these steps (Plausible):

1. Log in to Plausible. In the top-right menu, click your account name and choose Account Settings.
2. Open the Security section. Under Two-Factor Authentication (2FA), click Enable 2FA.
3. Plausible shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're looking at Plausible on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. Can't scan? Plausible also offers a code to paste, though its help doesn't name it. In Novaz, tap +, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key?
5. Click Proceed.
6. On the Setup Two-Factor Authentication screen, type the 6-digit code from Novaz and click Verify.
7. Save the recovery codes, then click Finish.

Plausible doesn't say how often its codes change, so scan the QR code if you can: it carries the code settings, while a typed key always gets 6 digits every 30 seconds.

Save the recovery codes

The last setup screen offers Print Codes and Copy to Clipboard, and Plausible's screenshot of it shows ten codes. Each one signs you in once (Plausible). If the phone is lost and you have no up-to-date Novaz backup, these codes are your only self-service way back in. Keep them off that phone. More in 2FA backup codes.

To replace them, click Generate new in Security, confirm your password, click Generate New Codes, then Finish. The old set stops working.

When Plausible asks for a code

Plausible asks for a code the first time you log in on a new device (Plausible), and when you change your password in Account Settings (Plausible). Its help doesn't say how long a device stays trusted, though idle sessions end after 14 days (Plausible).

Making 2FA mandatory for a team

Since November 2025, team owners can require 2FA for everyone (Plausible):

1. In the top-right menu, click your account name, select the team, then open Team Settings.
2. In the General section, find Force Two-Factor Authentication (2FA) and click Enforce 2FA, then OK.

That includes you. Members without 2FA get an email and are sent to the setup, with no skip, the next time they open the team's sites. Their other teams aren't affected. Stop Forcing 2FA removes the rule (Plausible).

On Enterprise plans with single sign-on, every owner needs 2FA before Force Single Sign-On can be switched on (Plausible).

If Plausible rejects your code

Plausible's setup screen asks you to type the code before it expires or wait for a fresh one, so don't enter a code that's about to change. If codes keep failing, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?

Changing phones

Plausible's help has no phone-change steps. Using the controls it does document, do it while the old phone still works: click Disable 2FA, enter your password, then Enable 2FA and scan the new QR code with the new phone. You'll get fresh recovery codes. If Novaz has an iCloud backup or you kept a backup file, you can restore your accounts on the new iPhone instead and keep the same setup. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use a recovery code when Plausible asks for the 2FA code. Each one works once (Plausible).
2. End the lost phone's session. If that phone was logged in to Plausible, click the trash icon next to its session under Login management in Security (Plausible).
3. No codes left? Contact Plausible from the email address you log in with. Once it confirms the account is yours, it turns 2FA off so you can log in with your password and set it up again (Plausible). The contact page lists hello@plausible.io and says replies usually come within one business day. Plausible doesn't say what proof it asks for.

A password reset won't get you past 2FA: it stays on, and you still need an authenticator or recovery code (Plausible). See also Lost the phone with your authenticator app?

Turning 2FA off

In Security, click Disable 2FA, enter your password and click Disable 2FA again. Your authenticator codes and recovery codes stop working (Plausible). If a team you belong to forces 2FA, expect to be sent back to the setup before you can open that team's sites. In Novaz, open the account and tap Remove account.

Official Plausible Analytics help

• Enable two-factor authentication (2FA)
• Login management
• Change or reset your account password
• Recover access when an owner is unavailable
• Single Sign-On (SSO)
• Plausible changelog
• Contact us