Two-factor authentication (MFA)

Guides

DataLug sign-in is passwordless: you enter your email and verify a one-time code (or magic link) sent to your inbox. Two-factor authentication (MFA) adds an optional second step on top of that first factor: a rotating 6-digit code from an authenticator app on your phone.

MFA is opt-in and per user. You turn it on from your own profile; it does not affect anyone else on the account until they enable it too.

What is supported

• TOTP (RFC 6238) - the open standard every free authenticator app uses. Enroll with Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, FreeOTP, or any other TOTP app. No vendor to pick, no paid service.
• Recovery codes - 10 single-use backup codes issued at enrollment, for signing in if you lose your phone.
• Email-code fallback - at the second-factor step you can ask DataLug to email you a one-time code instead of using the app.

Not in this release: WebAuthn / passkeys, hardware security keys, "remember this browser" trusted devices, and SMS codes.

Enroll (turn MFA on)

1. Open Account -> Profile and find the Two-factor authentication card.
2. Click Add two-factor authentication.
3. Scan the QR code with your authenticator app. If you cannot scan, type the shown secret key into the app by hand.
4. Enter the current 6-digit code from your app, then click Verify and enable.
5. DataLug shows your 10 recovery codes once. Use Copy all or Download .txt and store them safely, then click Done.
6. The card now shows a green Two-factor enabled (TOTP) pill plus Regenerate recovery codes and Disable.

Save your recovery codes now

The recovery codes are shown only once, at this screen. If you lose both your authenticator app and your recovery codes, you will need an internal admin to reset your second factor.

Sign in with MFA

1. Sign in as usual: enter your email, then the one-time code (or magic link) from your inbox.
2. Because MFA is on, DataLug does not sign you in yet - it shows a second step asking for your authenticator code.
3. Enter the current 6-digit code from your app and click Verify.

At the second step you have two alternatives:

• Use a recovery code instead - switch the field to accept one of your saved backup codes. Each recovery code works only once.
• Email me a code - DataLug emails a one-time code to your address (valid about 10 minutes). Enter that code in the same field. This is the fallback for when you cannot reach your authenticator app.

Same protections as the first factor

Too many wrong codes lock the account temporarily, and the second-factor step is rate-limited per source.

Recovery codes

• You receive recovery codes at enrollment, and a fresh set whenever you regenerate.
• Each code is single-use - once you sign in with one, it stops working.
• To replace them, open Account -> Profile -> Two-factor authentication and click Regenerate recovery codes. Enter a current authenticator (or recovery) code to confirm. Regenerating immediately invalidates the previous set, so save the new codes.

Disable MFA

1. Open Account -> Profile -> Two-factor authentication.
2. Click Disable.
3. Enter a current authenticator or recovery code to confirm.

MFA is turned off, your stored secret and recovery codes are removed, and your next sign-in skips the second step. You can re-enroll at any time.

Reset (lost device and lost codes)

If you lose both your authenticator app and your recovery codes, contact your DataLug operator team. They can reset your second factor for you. The reset is recorded in the audit trail, and your next sign-in skips the MFA step so you can re-enroll from your profile.

Good to know

• The authenticator secret is encrypted at rest and is never sent back to the browser.
• TOTP codes rotate every 30 seconds. DataLug accepts the code from roughly 90 seconds around now to tolerate normal phone-clock drift. If your codes never validate, set your phone's clock to update automatically.
• The secret cannot be rotated in place. If it is ever exposed, disable MFA and enroll again.