Substack 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Substack account is the one you use to read newsletters, run a publication and post Notes. Two-factor authentication (2FA) is optional, and the only method Substack's help describes is an authenticator app. It doesn't mention text-message codes. The unusual part: you can't turn on 2FA until you've set up recovery questions, and those questions, not backup codes, are how you get back in if you lose your phone (Substack).
When Substack launched 2FA, it said "any app which supports time-based one-time passwords will do" (Substack). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Substack steps come from Substack's own help center and its 2022 product announcement, linked below, which we read on October 20, 2026. We haven't tested them on a Substack account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Substack's help describes these steps (Substack):
- Open your account Settings page at substack.com/settings and go to the Security section.
- Turn on the toggle next to Recovery questions and set up your questions.
- Turn on the toggle next to Turn on two-factor authentication. If that toggle is locked, your recovery questions aren't on yet.
- Substack shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, Substack also offers a setup key. In Novaz, tap +, then Enter key manually, type Substack as the Service and paste the key into Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz into Substack and click Enable two-factor authentication.
Substack says its codes have 6 digits and change every 30 seconds, which matches what Novaz uses for a typed key.
Labels may differ from older screenshots: the 2022 announcement put the setting under Account security, with buttons instead of toggles (Substack).
When Substack asks for a code
Once 2FA is on, Substack asks for a code from your app every time you sign in. It comes after your password or after the link or code Substack emails you, so it protects both ways in (Substack, Substack). The help doesn't mention trusted devices. On the Two-factor authentication page, type the code from Novaz and select Confirm.
Your recovery questions are the backup
Substack's help doesn't mention backup codes. Recovery questions do that job: Substack's settings describe them as a way to confirm it's you if you lose access to your email or your authenticator app (Substack). Substack strongly encourages every user to turn them on (Substack).
This matters with Novaz too: unless you've turned on iCloud backup or exported a backup file, its keys exist only on your iPhone. Save your answers somewhere safe, such as a password manager, exactly as you typed them.
If Substack rejects your code
Substack's help has no advice on rejected codes. First, check that you're typing the code from Novaz, not the 6-digit sign-in code Substack emails you.
Then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
Substack lets you reset 2FA yourself with your recovery questions (Substack):
- Sign in with your email link, email code or password.
- On the Two-factor authentication page, under Still not able to log in?, select Recover your account.
- Answer your recovery questions on the Reset Two-Factor Authentication page. The page can expire, so stay on it until you're done.
- Select Reset, then sign in again. 2FA is now off, and you can turn it back on in Settings.
Substack's help doesn't say what happens if you can't answer the questions. If you've lost access to your email address, it points you to its support page at substack.com/support (Substack). A chatbot answers first and passes your case to the Support team by email if it can't help. Paid creators hear back within 24 hours; other requests are prioritized by urgency (Substack). It doesn't say what proof it asks for.
More in Lost the phone with your authenticator app?
Changing phones or turning 2FA off
Substack's help doesn't describe moving 2FA to a new phone. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and keep the same Substack codes. See How to transfer your authenticator app to a new iPhone.
The current help page doesn't describe turning 2FA off in Settings either. The 2022 screenshot showed a Turn off button, but the page has changed since. The documented way to start over is the reset above, so check that you still know your recovery answers. Then turn 2FA on again in Settings and scan the new QR code with Novaz on your new iPhone.
