SmugMug 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
SmugMug is where many photographers store their library, run a portfolio site and sell prints. SmugMug calls its two-factor protection multi-factor authentication (MFA). It's optional, and it's open to every plan, to guest accounts and to collaborator logins (SmugMug). The only method its help describes is a time-based code from an authenticator app, which changes every 30 seconds. In this guide we use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the SmugMug steps come from SmugMug's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a SmugMug account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on MFA with an authenticator app
SmugMug's MFA article, last updated October 16, 2026, gives these steps (SmugMug):
- Sign in to SmugMug on the web and select the profile icon at the top right.
- Choose Edit My Profile and scroll down to the MFA section, below your email and password settings (SmugMug).
- Click Get Started. SmugMug shows a QR code.
- In Novaz, tap +, then Scan QR code. If SmugMug is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If scanning doesn't work, type the code SmugMug shows under the QR code (its help doesn't name it). In Novaz, tap +, then Enter key manually, put SmugMug in Service, and type the code as the Setup key. See What is a 2FA setup key?
- Type the current code from Novaz into the code box on SmugMug's setup screen and click Activate.
- SmugMug now shows your backup codes. Save them (see below), then click Got It.
SmugMug's password help calls the profile menu item My Site Profile instead, so the label you see may differ (SmugMug).
Scan from inside Novaz, not the Camera app
SmugMug's help warns about an iPhone trap. If you aim the built-in Camera app at the setup QR code instead of scanning from inside an authenticator app, the account lands in Apple's own verification-code feature in Settings, and never reaches your authenticator app (SmugMug). With Novaz, always start from + and Scan QR code. If this has already happened to you, read Apple Passwords vs an authenticator app.
Your eight backup codes
At setup SmugMug gives you eight backup codes, each good for one sign-in in place of the app code. If you haven't made a Novaz backup, its keys exist only on your iPhone, so these codes are your way back in if that phone is lost. Keep them on paper or in a password manager, not on the phone.
To get a fresh set, go to the profile icon, Edit My Profile, and Regenerate Backup Codes. All older codes stop working at once (SmugMug). More in 2FA backup codes.
Signing in afterwards
With MFA on, you log in with your email and password as before, and SmugMug then asks for the current code from your app. Its help doesn't mention any way to remember a trusted device.
Two more things to know:
- Capture One: SmugMug's plug-in supports MFA from version 0.5.2. After your SmugMug username and password, it asks for the one-time code from your app (SmugMug). If you're on an older version, update it.
- Collaborators: people you add as collaborators sign in with their own logins, and each can protect theirs with MFA (SmugMug).
If SmugMug rejects your code
SmugMug's help has no advice on rejected codes. Check:
- That you're reading the right app. If you used the Camera app at setup (above), the working code is in Apple's Passwords, not in Novaz.
- Your iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
Other causes are in Authenticator code not working?
Moving to a new iPhone
SmugMug doesn't describe moving MFA to another device. Its documented route is to turn MFA off and set it up again, so do that while the old phone still works: Disable MFA under Edit My Profile, then Get Started and scan the new QR code with Novaz on the new iPhone. Save any backup codes SmugMug shows. If you use Novaz's iCloud backup or a backup file, you can skip this and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
If you still have a backup code, sign in with it. SmugMug suggests that if the app is gone for good, you then turn MFA off and set it up again with your new authenticator (SmugMug).
If you've lost both the app and the backup codes, contact SmugMug's support team through its request form. Support runs an account verification process first, then turns off MFA so you can sign in and set it up again. The help doesn't say what proof Support asks for or how long the check takes. More in Lost the phone with your authenticator app?
Turning MFA off
Select the profile icon, choose Edit My Profile, and select Disable MFA (SmugMug). The help doesn't say whether SmugMug asks for a code first. Afterwards, open SmugMug in Novaz and tap Remove account.
