Toshl Finance 2FA: how to set up an authenticator app

Toshl Finance is a budgeting and expense tracker that keeps your spending, budgets and bank connections in sync across its web app and its iPhone and Android apps. Its two-factor authentication (2FA) is optional and works one way only: with an authenticator app. Toshl deliberately doesn't send codes by text message, because it considers SIM swapping too big a risk (Toshl). The backup is a set of recovery codes you download during setup. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Toshl steps come from Toshl's own blog post on two-factor authentication, linked below, which we read on October 24, 2026. That post dates from June 2017 and is the only official page we found that describes the setup, so the labels in today's app may differ. We haven't tested the steps on a Toshl account. The Novaz steps are checked against the app, version 1.0.5.

It covers Google, Facebook and Apple sign-in too

You can sign in to Toshl with an email and password or with a Google, Facebook or Apple account (Toshl). Toshl treats any of those as the first step. Once 2FA is on, it asks for the code from your authenticator app after that step as well, so someone who gets into your Google or Facebook account still can't open your Toshl data (Toshl).

Turn on 2FA with an authenticator app

Toshl's post describes these steps, starting in the web app (Toshl):

1. Go to toshl.com and Log in.
2. Open your user settings, Me, from the main menu.
3. Turn on Two-factor authentication. A setup wizard opens.
4. Toshl shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're doing this on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Download the file with your recovery codes and put it somewhere safe (more below).
6. Type the current 6-digit code from Novaz into Toshl to confirm it works. That finishes the setup.

Toshl's codes are 6 digits and change every 30 seconds, which is the usual setting. The post only mentions scanning the QR code. It doesn't say whether the wizard also shows a text key. If it does, you can tap +, then Enter key manually in Novaz and paste it as the Setup key. See What is a 2FA setup key?

Save the recovery codes

The recovery code file is your only documented way back in without your phone. Toshl gives you 10 codes, and "Each code can only be used once," so they cover 10 sign-ins in total (Toshl). Toshl suggests keeping them on your computer, on an external drive, or on paper.

If you haven't turned on Novaz's iCloud backup or exported a backup file, these codes are what gets you back in after losing the phone, and they still cover you if your backup is out of date. Store a copy away from the phone. The post doesn't say whether you can download a fresh set later. See 2FA backup codes.

When Toshl asks for a code

Toshl asks whenever you sign in from a signed-out state, not every time you open the app (Toshl):

• Web app: if you tick Remember me at sign-in, Toshl won't ask again until you log out or the session expires. Closing the browser alone usually doesn't end it.
• Mobile apps: you type the code once when you first sign in. You'll be asked again only after logging out under Me or reinstalling the app.

Because the phone app stays signed in, Toshl also suggests locking it with a passcode or fingerprint.

If Toshl rejects your code

Toshl's post doesn't cover rejected codes. Since its codes are time-based, check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Make sure you type the code before it changes. More causes are in Authenticator code not working?

If you lose your phone or delete the app

Sign in as usual, and when Toshl asks for the authentication code, choose the option to log in with a recovery code instead. Then go to Me, turn off Two-factor authentication, and set it up again with your new phone or app (Toshl).

Toshl doesn't document what happens if you've lost both your phone and your recovery codes. For questions its pages don't answer, its FAQ points to Toshl's private support at support.toshl.com (Toshl). It doesn't say what proof support asks for or how long a reset takes. See also Lost the phone with your authenticator app?

Moving to a new iPhone

Toshl doesn't describe a transfer. On the Novaz side, an iCloud backup or backup file lets you restore your accounts on the new iPhone with the same codes. Without one, the approach that follows from Toshl's post is to turn 2FA off under Me and set it up again on the new phone. Do it while you still have the old phone, or keep a recovery code ready. See How to transfer your authenticator app to a new iPhone.

Turning 2FA off

Switch Two-factor authentication off under Me (Toshl). The post doesn't say whether Toshl asks for a code before it lets you. Afterwards, open the Toshl account in Novaz and tap Remove account.

Official Toshl help

• Two-Factor Authentication and How to Use It (Toshl Finance Blog, June 15, 2017)
• Frequently Asked Questions (FAQ)