Workflowy 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Workflowy is an outliner for notes, to-do lists and long nested documents. Workflowy calls its two-step sign-in multi-factor authentication (MFA). It's optional, and the only second factor its help pages describe is an authenticator app that makes six-digit codes (Workflowy). There's no text-message option to fall back on.
The thing to know before you start: Workflowy's help says that if you lose your authentication device, your recovery codes are the only way to sign back in. It doesn't describe any other route. So the recovery codes matter more here than on most services.
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Workflowy steps come from Workflowy's own help center, linked below, which we read on October 21, 2026. Its web pages refused automated requests, so we read the articles through the help center's public article feed, and the older MFA article also in an archived copy on web.archive.org from May 2025. We haven't tested the steps on a Workflowy account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on MFA with an authenticator app
Workflowy's newer help article gives these steps (Workflowy):
- Click the options button in Workflowy's menu bar, then click Settings.
- Turn on the MFA toggle.
- Workflowy asks you to confirm your password. Enter it and click Confirm password.
- Click Setup MFA.
- Copy and save your recovery codes somewhere safe, away from your phone. Then click Next.
- Workflowy shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Click Next, type the six-digit code from Novaz, and click Close.
The older MFA article says that if you can't use a camera, you can pick enter this code on the QR screen to get a text key instead (Workflowy). In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key? Workflowy doesn't say how often its codes change, so scanning the QR code is the safer choice.
By default, Workflowy signs you in with a code it emails you, and a password is something you add yourself in Settings with Set Password (Workflowy). The MFA setup asks for your password, and the help doesn't say what happens if you've never set one. If you only use email codes, you may need to set a password first.
The newer article lists Authy, 1Password and LastPass as suggested apps and says Workflowy doesn't recommend Google Authenticator, without giving a reason.
Save your recovery codes
Workflowy shows the recovery codes before the QR code, during step 5. Copy, print or download them. If that phone is lost or broken and you have no Novaz backup (iCloud backup or a backup file), these codes are your way back in. See 2FA backup codes.
You can see the codes again later (Workflowy):
- To view them: open Settings from the options button and click Show recovery codes.
- To replace them: click Show recovery codes, then Get new codes, then Ok in the confirmation. Your old codes stop working, so save the new set right away.
When Workflowy asks for a code
You type the authenticator code after your usual first step, whether that's your password or the code Workflowy emails you (Workflowy). Once you're signed in, Workflowy doesn't ask again while you stay signed in. The help doesn't mention trusted devices or extra prompts for account changes.
If Workflowy rejects your code
Workflowy's help pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Workflowy doesn't document a phone switch. What it does document is that turning MFA off and back on makes you run the setup again (Workflowy). So, while the old phone still works, turn MFA off, turn it on again, and scan the new QR code with the new phone. You'll get a new set of recovery codes to save. If you've turned on iCloud backup or exported a backup file in Novaz, you can restore your accounts on the new iPhone instead, and the Workflowy codes keep working. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with one of your recovery codes, then set up MFA again on your new phone. Workflowy's help warns that losing both your authentication device and your recovery codes risks losing access to your account. It describes no support process for removing MFA, no proof of identity it would accept, and no time frame. The only contact address we found on Workflowy's site is help@workflowy.com, in its privacy policy, and no page says that address can reset MFA. More in Lost the phone with your authenticator app?
Turning MFA off
Open Settings from the options button, turn off the MFA toggle, and click Disable when Workflowy asks you to confirm (Workflowy). Then open the Workflowy entry in Novaz and tap Remove account.
