Time-based one-time codes (TOTP) for console sign-in, compatible with any standard authenticator app. Off by default.

My Account → Two-Factor Authentication, or the entry in the profile menu at the top right.

1. Scan the QR code with your authenticator app, or type the key by hand.
2. Enter a code from the app to confirm. Enrollment is not complete until a code verifies — this stops an account being locked out by a mis-scanned key.
3. Save the ten recovery codes shown afterwards.

Ten single-use codes, generated at enrollment. Each works once, in place of an authenticator code, and is consumed when used.

Regenerate them from the same screen; regenerating invalidates all previous ones. The console warns you when few remain.

Keep them somewhere other than the device holding the authenticator app. If you lose both, an administrator has to reset your second factor.

Settings → Security. Two switches:

• Require two-factor authentication for all users
• Require two-factor authentication for administrators — superseded when the all-users switch is on

A signed-in user who has not enrolled is redirected to the setup screen and cannot use the console until they do. Only that screen and logout stay reachable.

Turning enforcement on does not sign anyone out. It takes effect on each user's next request.

Since 1.14.0. When a user with 2FA signs in to the RustDesk desktop or mobile client with a username and password, the client shows its own code dialog after the password, and the console issues a token only for a correct code. No client change is needed; the stock client has the dialog.

• The prompt lasts 10 minutes, only works from the device that gave the password, and allows five wrong codes before the password must be entered again.
• Recovery codes work on the console only. The client's field takes 6 digits.
• With 2FA required and the user not enrolled, the client refuses the sign-in and tells them to set it up in the console first.
• Clients that were already signed in keep their token. The rule applies at the next password sign-in.
• Continue with SSO is unaffected, as on the console.

A user who has lost their authenticator and their recovery codes needs an administrator: Users → edit the user → Reset 2FA. That clears the secret, the flags and every recovery code, and the action is written to the console audit log. The user enrolls again from scratch.

If nobody who can perform that reset can sign in either:

php artisan cortendesk:2fa-reset <username>

On Docker:

docker exec -it <container> php artisan cortendesk:2fa-reset <username>

That disables 2FA for the named user so they can sign in with their password.

The second factor is asked for after the password is accepted, so it protects against a stolen or guessed password. It is not a substitute for one.

Repeated wrong codes are rate limited and raise a Console brute force entry in the alarm log — someone grinding second factors already holds a working password, which is worth knowing about.

A code cannot be replayed: once a code from a given 30-second step has been accepted, that step and any earlier one are refused.

Single sign-on. SSO sessions are exempt, including from enforcement — the identity provider authenticated the user and applies its own policy.

Emailed sign-in codes. A user with 2FA enrolled is never also asked for an emailed code. The authenticator app always wins, so a sign-in raises at most one challenge.

Password reset. Resetting a password does not clear 2FA. The second factor is still required at the next sign-in — a reset returns the password only.