Stop 10 · Authentication & AuthorizationTopics · 10/11

Multi-Factor Authentication

In short

Passwords leak, get reused and get phished. Multi-factor authentication asks for a second proof, usually a code from your phone, so a stolen password alone isn't enough.

Requiring a second proof of identity beyond a password — typically a time-based one-time code (TOTP) from an authenticator app — significantly reducing account takeover risk.

The blob character and a bank manager turn two keys in one locker together.

Think of it like this

The bank locker with two keys

A bank locker opens only when your key and the manager's key turn together. Steal one and you still can't open it. MFA is the same idea: something you know (your password) plus something you have (your phone), and both are needed.

Watch it happen

Password plus a TOTP code

You

Authenticator

Server

email + password

1/6You log in with your password. It's correct, but that's only step one.

The big ideas

What you need to know

Different kinds of proof

Something you know (password), have (phone, security key) or are (fingerprint). MFA combines two kinds.

TOTP is time-based

The app and server share a secret at setup. Each turns it plus the current time into the same 6-digit code.

Passkeys resist phishing

Security keys and passkeys check the website's real domain, so a fake login page can't capture them.

Plan for lost phones

Give users one-time backup codes at setup, stored hashed, so a lost phone doesn't lock them out.

See it in code

Walk through the code

1import { authenticator } from "otplib";2import QRCode from "qrcode";3 4// Setup: create a secret and show it as a QR code5const secret = authenticator.generateSecret();6const uri = authenticator.keyuri("riya@college.edu", "MyApp", secret);7const qrDataUrl = await QRCode.toDataURL(uri);8await db.users.update(userId, { totpSecret: encrypt(secret), mfaEnabled: false });9 10// Login: check the 6-digit code the user typed11export function checkTotp(code: string, storedSecret: string) {12  return authenticator.verify({ token: code, secret: decrypt(storedSecret) });13}

1/3At setup, create a random secret and turn it into an otpauth:// QR code for the authenticator app.

encrypt and decrypt are your helpers. Unlike a password, the TOTP secret must be recoverable, so you encrypt it instead of hashing it.

Save yourself the pain

Common mistakes

Oops

Relying only on SMS codes for high-value accounts.

Do this instead

SMS can be intercepted or moved with a SIM swap. Prefer authenticator apps or passkeys, with SMS only as a fallback.

Oops

Letting users retry MFA codes forever.

Do this instead

Rate-limit attempts. A 6-digit code has a million options, which is guessable if nothing stops the guessing.

Your mission

Add TOTP to a login

~40 min

Quick check

Your password leaks in a breach, but you have TOTP MFA turned on. What can the attacker do?

Go deeper

1Implement TOTP-based MFA using a library like `speakeasy` or `otplib`.
2Generate a QR code so users can add your app to Google Authenticator.
3Design backup codes for when a user loses access to their authenticator.