Whimsical 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Whimsical is the online workspace for boards, flowcharts, mind maps, wireframes and docs that teams edit together. Its two-factor authentication (2FA) is optional, though Whimsical strongly recommends it, and it has one method: a code from an authenticator app, on top of your email and password. There's no text-message option in its help. The detail that matters most comes at the end of setup: Whimsical hands you 10 recovery codes, and its help says that without them you can't get back into your account if you lose your phone (Whimsical).
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Whimsical steps come from Whimsical's own help pages on its Learn site, linked below, which we read on October 21, 2026. We haven't tested them on a Whimsical account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Whimsical's help describes these steps (Whimsical):
- Sign in to Whimsical. Click the current workspace name in the top left corner, then open Settings and choose Account.
- Click Enable two-factor authentication.
- Enter your password again when Whimsical asks.
- Whimsical shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If Whimsical is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Novaz now shows a 6-digit code for Whimsical. Type it into Whimsical to confirm the connection.
- Whimsical then gives you 10 recovery codes. Download or print them before you close the window.
Whimsical's help only talks about scanning the QR code. It doesn't mention a text key you could type instead. If you see one, in Novaz tap +, then Enter key manually, and paste it as the Setup key. The help says the codes change every 30 seconds, which is what a typed key gives you. See What is a 2FA setup key?
Save the 10 recovery codes
Whimsical's help gives these codes one job: getting you into your account when your phone isn't available. It's also blunt about the alternative: "Without these codes, you will not be able to access your Whimsical account" (Whimsical). The help doesn't describe a support process that turns 2FA off for you, and it doesn't say whether used codes can be replaced with new ones.
Unless you've turned on iCloud backup or exported a backup file in Novaz, its keys exist only on that iPhone, so a lost or broken phone takes the Whimsical key with it. Keep the codes somewhere other than that iPhone, such as a password manager on another device or a printed copy at home. More in 2FA backup codes.
Signing in afterwards
Each time you sign in with your email and password, Whimsical asks for the current code from your authenticator app before letting you in (Whimsical). Its help doesn't mention a way to remember a trusted device.
Whimsical also caps how many devices can be signed in to one account at once. Signing in on one more device signs out the oldest session (Whimsical), and signing back in there means another code.
The 2FA article only covers email and password sign-in. It doesn't say how 2FA works if your workspace uses SAML single sign-on, which Whimsical offers on its Business plan (Whimsical).
If Whimsical rejects your code
Whimsical's help doesn't cover rejected codes. The usual cause is a phone clock that has drifted. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
Whimsical doesn't document moving 2FA to a new phone. What its help does support is turning 2FA off and on again, so do that while you still have the old iPhone: turning it off needs a code from it. Then scan the new QR code with the new phone. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with your email and password, and use one of your recovery codes when Whimsical asks for the authenticator code. Once you're in, set 2FA up again on your new phone.
If you have no recovery codes, Whimsical's 2FA article says you won't be able to get into the account. Whimsical's password reset page, which sends a link to your account email, doesn't mention 2FA at all (Whimsical). The only contact the help offers is its support address, help@whimsical.com, or the form on its contact page (Whimsical). It doesn't say what proof support would ask for or whether it can remove 2FA at all. More in Lost the phone with your authenticator app?
Turning 2FA off
Go back to your account settings and click Disable next to two-factor authentication. Whimsical asks for a code from your authenticator app to confirm (Whimsical). After that, you can remove Whimsical from Novaz: open the account and tap Remove account.
