Two-factor authentication that people
actually keep turned on
A password alone is one leak away from a compromised account, and most 2FA implementations fail at the recovery step, not the login step, locking out real users the first time they lose a phone. We build the login flow and the recovery path together, so the second factor actually gets used instead of disabled after the first support ticket.
What it is
Two-factor authentication adds a second proof of identity beyond a password: a time-based code from an authenticator app, a code sent by SMS or Telegram, or a backup code generated in advance. The login step itself is the easy part to build; the part that determines whether 2FA actually survives contact with real users is recovery, what happens when someone loses the device generating their codes, and enforcement, deciding which accounts actually require it.
When you need it (and when you do not)
You need this for any account that can cause real damage if compromised: an admin panel, a system handling payments or customer data, an account with access to a business’s ad accounts or CRM. It is close to mandatory the moment a login grants access to money, personal data, or infrastructure, and it is cheap enough that there is rarely a good reason to skip it for those roles.
You do not need to force 2FA on every low-stakes account on day one; mandatory 2FA with no easy recovery path is exactly what causes people to find workarounds (writing codes down insecurely, disabling 2FA at the first inconvenience) that undermine the whole point. We usually recommend optional-by-default for regular users and required for admin and privileged roles, then expanding based on your actual risk.
How we build it
TOTP is the default, implemented with a standard library, because it works offline, costs nothing per login, and is what most security-conscious users already expect from Google Authenticator or a password manager’s built-in support. Where your users are less technical or expect a familiar flow, we add SMS or Telegram-based codes as a second option, with rate limiting on both channels so a login endpoint cannot be used to brute-force a code or spam someone’s phone.
Backup codes are generated once, at setup, shown to the user exactly once, and stored hashed, the same way passwords are, never in plain text. Recovery for a genuinely lost device and lost codes goes through a defined, logged process, usually an admin verifying identity through another channel, rather than an insecure shortcut that quietly defeats the feature. Every 2FA event, setup, successful login, failed attempt, recovery, is logged, both for the user’s own security history and for your own incident review if something looks wrong later.
What to watch
SMS-based codes carry real risk from SIM-swap attacks in some markets, which is worth knowing before relying on SMS as your only second factor for high-value accounts. 2FA that is mandatory with no workable recovery path is a support burden waiting to happen; we build the recovery flow as a first-class part of the feature, not an afterthought. Running cost is near zero for TOTP and a small per-message cost if SMS is in the mix.
Price and timeline
| Option | Price | What it covers | Timeline |
|---|---|---|---|
| MVP | from $900 | TOTP for one application, backup codes, basic recovery | 3 to 7 days |
| Production | from $2,000 | TOTP plus SMS or Telegram, enforcement rules by role, full audit log | 1 to 2 weeks |
Related
This is often built alongside single sign-on and OAuth and passwordless login, and complements role-based access control once identity is confirmed. It is part of the development service. The login-hardening work here matches secure Telegram Mini App infrastructure and the support-bot access patterns in visa center AI support bots.
Ready to add 2FA without creating a support headache? Get in touch and tell us who logs in today.
FAQ
How much does two-factor authentication cost?
From $900 to add TOTP-based 2FA to an existing login system; adding SMS as a second channel or building a custom recovery flow adds time.
How long does it take?
3 to 7 days for a standard login system; longer if your authentication is spread across more than one application.
TOTP app, SMS, or something else?
TOTP apps are the most secure and the cheapest to run, with no per-message cost; SMS is more familiar to non-technical users but costs per message and is weaker against SIM-swap attacks. We recommend based on who is actually logging in.
What happens if someone loses their phone?
Backup codes generated at setup cover this case without disabling 2FA entirely; for a user who lost both the phone and the codes, we build a defined recovery path (identity verification by an admin, for instance) rather than an insecure 'just email us' bypass.
Can we require 2FA only for admins?
Yes, enforcement rules are configurable: optional for everyone, required for admin or privileged roles, or required for all accounts, set according to your actual risk profile.