SourceForge 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your SourceForge account is the one you use to host open source projects, upload release files, commit code and file tickets on sourceforge.net. SourceForge calls its two-factor authentication "multifactor authentication", and it works with any app that makes 6-digit time-based codes. Its documentation recommends turning it on but doesn't say it's required for anything (SourceForge).
One fact matters more than the steps: SourceForge says it can't recover an account if you lose both your two-factor device and your backup codes (SourceForge). So saving the recovery codes isn't optional in practice.
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the SourceForge steps come from SourceForge's own documentation wiki, including its screenshots, which we read on October 21, 2026. We haven't tested them on a SourceForge account. The setup page and its screenshots date mostly from 2016, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
SourceForge's documentation describes these steps (SourceForge):
- Sign in and open your account settings at sourceforge.net/auth/preferences, then find the Multifactor Authentication section. It says multifactor authentication is currently disabled.
- Select Set up multifactor authentication.
- The next page shows a barcode (a QR code). In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Novaz adds the account and starts showing codes. Type the current 6-digit code into SourceForge to finish.
SourceForge then emails you to confirm that two-factor authentication is on, and the Multifactor Authentication section shows it as enabled.
The documentation only describes scanning the barcode. It doesn't mention a text key you can type instead, so plan to scan. If the page does offer a key, see What is a 2FA setup key?
Save the recovery codes now
Once 2FA is on, the Multifactor Authentication section has a View recovery codes link. SourceForge's page says you can view or change the codes at any time, but only while you're signed in (SourceForge). That's the catch: you can't fetch them after you've lost your phone.
Open them right after setup and store them away from your iPhone, on paper or in a password manager. Without a Novaz backup, its keys exist only on your iPhone, so these codes are your way back in. The documentation doesn't say how many codes you get or whether each works only once. More in 2FA backup codes.
Git, SFTP and other shell services
This part is unusual. If you push code over HTTPS or upload files with scp, sftp or rsync and haven't set up SSH keys, SourceForge asks for your password with the 6-digit code typed straight after it, with no space. If your password were hunter2 and Novaz showed 482913, you'd enter hunter2482913. The same goes for Subversion commits (SourceForge).
If a tool asks more than once, SourceForge says each prompt needs a fresh code. Novaz shows a new code every 30 seconds, so wait for it to change before you answer the next prompt.
SourceForge recommends SSH keys for these services so you don't have to type a password and code each time.
If SourceForge rejects your code
SourceForge's documentation doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. For shell services, check that you added the code to the end of your password, not the start. Other causes are in Authenticator code not working?
Changing phones
The Multifactor Authentication section offers two options for this (SourceForge):
- View existing configuration shows your current setup, and SourceForge says you can use it to add more devices that share the same key. Scan it with Novaz on the new iPhone.
- Regenerate multifactor key (e.g. for a new phone) creates a new key. SourceForge doesn't say what happens to the old one, so check that the new phone's codes work before you remove the old entry.
Both need you to be signed in, so do this while you still have the old phone. With Novaz's iCloud backup or a backup file, you can skip both and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use one of your recovery codes to sign in, then set up the authenticator again from Multifactor Authentication.
Without those codes, SourceForge's documentation is blunt: account recovery isn't possible (SourceForge). Email recovery helps only with a lost password. SourceForge's general route for help is a support ticket, reviewed within two business days (SourceForge), but the ticket form asks you to sign in, and no page says support can remove two-factor authentication for you. More in Lost the phone with your authenticator app?
Turning 2FA off
The Multifactor Authentication section has a Disable link (SourceForge). The documentation doesn't say whether it asks for a code first. After you turn it off, you can remove the SourceForge entry from Novaz: open it and tap Remove account.
