Upwork 2FA: how to set up an authenticator app

Freelancers use their Upwork account to find work and get paid, and clients use it to hire and pay. Upwork calls its optional second sign-in step two-step verification, with four methods: a code from an authenticator app, a code by text message, a prompt in the Upwork mobile app, or a security question (Upwork). Upwork recommends the authenticator app and says it "provides the highest level of security we offer" (Upwork).

Upwork's help pages don't mention backup codes, so your safety net is a second method. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Upwork steps come from Upwork's own help center, linked below, which we read on October 20, 2026. Upwork's security reset form blocks automated access, so we read an archived copy of it on web.archive.org, saved in April 2024. We haven't tested the steps on an Upwork account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

From Upwork's newest help page (Upwork):

1. Go to Account settings on the website, or Settings in the Upwork app, then Password and Security.
2. Turn on the toggle next to Authenticator app code. If another method is already on, Upwork asks you to pass it first.
3. Upwork shows a QR code and a secret key. In Novaz, tap +, then Scan QR code. If it's on the same iPhone, in the Upwork app, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. To type the secret key instead, tap +, then Enter key manually. Fill in Service (for example, Upwork) and paste the key into Setup key. Novaz needs at least 16 characters, so if Upwork's key is shorter, scan the QR code.
5. Enter the six-digit code from Novaz and choose Verify.

Other Upwork pages write the settings page as Password & Security, so the label on your screen may differ a little.

No backup codes: add a second method

Upwork advises turning on more than one method. When it asks you to verify, you can use any of them, and the security question counts as a backup (Upwork). Novaz keys stay on your iPhone unless you back them up, so add one of these:

• Security question. In Password and Security, select Set up now next to Security question and answer, then choose a question and type your answer (Upwork). Store the answer safely.
• Text message. Upwork only offers it after you verify your identity or add a billing method, and it doesn't accept VoIP numbers (Upwork).
• Mobile app prompt. This needs the Upwork app, signed in, with notifications on. If it's on the same iPhone as Novaz, losing that phone takes out both.

When Upwork asks for a code

Upwork asks for a second step at login and when you open parts of your account such as settings or payments, and to add, change or remove a method (Upwork). A password reset can ask for it too (Upwork).

Face ID or Touch ID in the Upwork app can replace your password, but Upwork's Enterprise help says it can't pass a two-step check (Upwork).

If Upwork rejects your code

Upwork points to the phone's clock: if you set it by hand or changed time zones, switch it back to automatic (Upwork). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

Upwork says to move your authenticator app to the new phone, then turn the authenticator off and on again in Password and Security to pair it (Upwork). With Novaz, moving the app means restoring it on the new iPhone from iCloud backup or a backup file. Without a Novaz backup, the off-and-on step is the whole job. Do it while you still have the old iPhone, since removing the method needs a code. Then set it up with Novaz on the new phone, and on the old one tap the Upwork entry and Remove account. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

First, at the verification screen, pick another method you set up. Upwork's Enterprise help calls the switch Try another method (Upwork).

If none of them work, Upwork's route is the Reset your Security Information form (Upwork). The archived copy of the form asks for your phone number on file, address, rough join date, sign-up country and payment details such as a transaction date. It says Upwork then resets all your two-step methods and your password, and emails a temporary password (archived copy). The form may have changed since. Upwork doesn't say how long it takes.

Don't open a new account meanwhile: Upwork allows one per person and may suspend both (Upwork). More in Lost the phone with your authenticator app?

Turning it off

In Password and Security, turn off the toggle next to Authenticator app code, then choose Delete. Verify again, then confirm that you want to delete and disable the method (Upwork).

Official Upwork help

• How to manage two-step verification on Upwork
• How our system-level security measures protect you on Upwork
• How to manage your login options on Upwork
• How to fix login issues on Upwork
• How to verify your phone number on Upwork
• Use two-step security verification (Upwork Enterprise help)
• Reset your password or security answer (Upwork Enterprise help)
• Reset your Security Information form (read in an archived copy from April 2024)