Two-factor authentication that people
actually keep turned on
A password alone is one leak away from a compromised account. Most 2FA builds fail at the recovery step, not the login step, and lock out real users the first time they lose a phone. We build the login flow and the recovery path together, so the second factor gets used instead of switched off after the first support ticket.
The part that breaks is not the login screen
Two-factor authentication adds a second proof of identity beyond a password. That can be a time-based code from an authenticator app, a code sent by SMS or Telegram, or a backup code generated in advance. The login step itself is the easy part to build. The part that decides whether 2FA actually survives contact with real users is recovery: what happens when someone loses the device that generates their codes. Enforcement matters just as much: deciding which accounts actually need to require it.
Where this is worth the setup cost
You need this for any account that can cause real damage if someone breaks in. Think an admin panel, a system handling payments or customer data, an account with access to a business’s ad accounts or CRM. It is close to mandatory the moment a login grants access to money, personal data, or infrastructure. It is also cheap enough that skipping it for those roles rarely makes sense.
You do not need to force 2FA on every low-stakes account on day one. Mandatory 2FA with no easy recovery path pushes people toward workarounds, writing codes down somewhere insecure, turning 2FA off at the first inconvenience, that defeat the whole point. We usually recommend optional-by-default for regular users and required for admin and privileged roles, then expanding from there based on your actual risk.
How the code, the backup plan and the audit trail fit together
TOTP is the default, built on a standard library. It works offline, costs nothing per login, and is what most security-conscious users already expect from Google Authenticator or a password manager’s built-in support. Where your users are less technical, or expect something more familiar, we add SMS or Telegram-based codes as a second option. Rate limiting sits on both channels, so a login endpoint cannot be used to brute-force a code or spam someone’s phone.
Backup codes get generated once, at setup. They show to the user exactly one time and get stored hashed, the same way passwords are, never in plain text. Recovery for a genuinely lost device and lost codes runs through a defined, logged process. Usually that means an admin verifying identity through another channel, rather than an insecure shortcut that quietly defeats the feature. Every 2FA event gets logged too: setup, successful login, failed attempt, recovery. That log serves the user’s own security history and your incident review if something looks wrong later.
What to watch
SMS-based codes carry real risk from SIM-swap attacks in some markets. That is worth knowing before you rely on SMS as your only second factor for high-value accounts. 2FA that is mandatory with no workable recovery path turns into a support burden sooner or later. We build the recovery flow as a first-class part of the feature, not an afterthought bolted on later. Running cost sits near zero for TOTP, with a small per-message cost if SMS is in the mix.
Price and timeline
| Option | Price | What it covers | Timeline |
|---|---|---|---|
| MVP | from $900 | TOTP for one application, backup codes, basic recovery | 3 to 7 days |
| Production | from $2,000 | TOTP plus SMS or Telegram, enforcement rules by role, full audit log | 1 to 2 weeks |
Related
This is often built alongside single sign-on and OAuth and passwordless login, and it complements role-based access control once identity is confirmed. It is part of the development service. The login-hardening work here matches secure Telegram Mini App infrastructure and the support-bot access patterns in visa center AI support bots.
Ready to add 2FA without creating a support headache? Get in touch and tell us who logs in today.
FAQ
How much does two-factor authentication cost?
From $900 to add TOTP-based 2FA to an existing login system. Adding SMS as a second channel or building a custom recovery flow adds time and cost on top.
How long does it take?
3 to 7 days for a standard login system. Longer if your authentication is spread across more than one application.
TOTP app, SMS, or something else?
TOTP apps are the most secure option and the cheapest to run, with no per-message cost. SMS feels more familiar to non-technical users, but it costs per message and is weaker against SIM-swap attacks. We recommend one or the other based on who is actually logging in.
What happens if someone loses their phone?
Backup codes generated at setup cover that case without turning 2FA off entirely. If someone loses both the phone and the codes, we build a defined recovery path instead. An admin verifying identity is one option. We avoid an insecure email-us-and-we-will-sort-it bypass.
Can we require 2FA only for admins?
Yes. Enforcement rules are configurable: optional for everyone, required for admin or privileged roles, or required for all accounts. We set it according to your actual risk profile.