Skip to content
Novaz AuthenticatorGET

Toodledo 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2-Step Authentication
  2. Toodledo's apps need an app-specific password
  3. Backup codes
  4. If Toodledo rejects your code
  5. If you lose your phone
  6. Changing phones
  7. Official Toodledo help

Toodledo is a web-based to-do list and productivity tool, with apps for iPhone and Android. It calls its two-factor sign-in 2-Step Authentication. It's optional: you turn it on in your account settings, and after that, signing in on the website takes your password plus a one-time code from an app on your phone (Toodledo, Toodledo).

The part most people trip over comes later: Toodledo's own mobile apps, and other apps that connect to your account, don't ask for that code. They need a separate app-specific password instead. This guide covers both. It uses Authenticator App - Novaz on iPhone for the code, but any authenticator app works the same way.

How we checked this guide: Toodledo's current help page on this topic loads its answer only with JavaScript, and the archived copies we checked don't contain the answer either, so we couldn't read it. The Toodledo details come instead from Toodledo's security feature page and from posts by Toodledo's founder, Jake, in Toodledo's official forums, linked below, which we read on October 21, 2026. Those posts date from 2014 and 2015, and we haven't tested anything on a Toodledo account, so the screens and labels may have changed. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2-Step Authentication

Toodledo announced the feature in April 2014 and said you enable it in your account settings. Its founder added that the setup walks you through getting the authenticator app, and that apps exist for both iOS and Android (Toodledo). Toodledo doesn't publish the individual screens, so here is the outline:

  1. Sign in to Toodledo on the website and open your account settings.
  2. Find 2-Step Authentication and start the setup.
  3. When the setup gets to the authenticator app, open Novaz. If Toodledo shows a QR code, tap +, then Scan QR code, and point the camera at it. If the code is on your iPhone's own screen, take a screenshot and tap +, then Choose a photo.
  4. If Toodledo gives you a text key instead, tap +, then Enter key manually. Type Toodledo as the Service, your email in Account if you like, and the key as the Setup key. See What is a 2FA setup key?
  5. Type the code Novaz shows to finish, as the setup asks.

Toodledo's pages don't say whether the setup shows a QR code, a key, or both. They also don't say how many digits its codes have. Scanning is the safer choice when you have it, because a QR code carries the code settings to your app.

Toodledo's apps need an app-specific password

Once 2-Step Authentication is on, the founder's advice was to create an app-specific password on the 2-Step page of the Toodledo website. You then type it into the Toodledo app on your phone or tablet in place of your normal password (Toodledo, Toodledo). The same goes for other apps that sign in to your Toodledo account; the setup explains how to use the password with them (Toodledo). If an app says it can't sign in right after you turned on 2-Step Authentication, this is the likely reason (Toodledo).

Scripts work differently. The founder said there are two ways to sign in with 2-Step Authentication on: the website with your email, password and a one-time code, or Toodledo's API with an app-specific password. A script that downloads the website's backup tool can only use the first way (Toodledo). The API's sign-in is described in Toodledo's developer documentation.

Backup codes

None of the Toodledo pages we could read mention backup or recovery codes. Unless you turn on Novaz's iCloud backup or export a backup file, its keys exist only on that iPhone, so keep access to the email address on your Toodledo account: it's your way back in (below).

If Toodledo rejects your code

Toodledo's readable pages don't cover rejected codes. Check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

If you lose your phone

According to the founder, you can turn off 2-Step Authentication by having Toodledo send a confirmation email containing a special link (Toodledo). His post doesn't describe where you ask for that email, and Toodledo doesn't say what to do if you've also lost access to that inbox. Toodledo's contact page is the place to ask. See also Lost the phone with your authenticator app?

Changing phones

Toodledo doesn't document moving the authenticator to a new phone. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and keep the same codes. Without one, you'll need to set up Toodledo again on the new phone. Do it while the old phone still works, and check which steps your account settings offer. See How to transfer your authenticator app to a new iPhone.

Official Toodledo help

More guides: Productivity and remote work