---
path: onboarding/member-onboarding/security-setup.mdx
title: Security setup
sidebar_position: 4
slug: security-setup
pagination_next: null
pagination_prev: null
description: >-
  How to enable two-factor authentication (2FA) in Passwork using TOTP apps
  (Google Authenticator, Microsoft Authenticator, Passwork 2FA) or hardware security keys.
keywords:
  - Passwork
  - two-factor authentication
  - 2FA
  - TOTP
  - Google Authenticator
  - Microsoft Authenticator
  - Passwork 2FA
  - security key
  - WebAuthn
  - account security
---

Two-factor authentication (2FA) adds a second verification step when signing in to Passwork. Even if your password is compromised, an attacker cannot access your account without the second factor.

:::tip
Your administrator may not enforce 2FA as a mandatory policy. To ensure proper security, set it up immediately after activating your account rather than wait for it to become mandatory.
:::

## Open the 2FA settings

1. Click your profile icon or **Settings and users** at the top of Passwork interface.
2. Open the **Authentication** page.
3. Scroll to the **Two-factor authentication (2FA)** section.

To make changes, click the **lock icon** in the top-right corner of the page to unlock it for editing.

<ImageComponent
  src="/img/assets/2fa-1.png"
  alt="Two-factor authentication section in account settings"
  format="regular"
/>

## Connect a TOTP authenticator app

Use the Passwork 2FA app or any third-party app that supports TOTP (Time-based One-Time Passwords), such as Google Authenticator or Microsoft Authenticator.

1. In the **Passwork 2FA and TOTP** section, click **Connect**.

<ImageComponent
  src="/img/assets/2fa-2.png"
  alt="2FA Connect button"
  format="regular"
/>

2. And choose the 2FA method you want to use.

<ImageComponent
  src="/img/assets/2fa-3.png"
  alt="2FA method selection"
  format="regular"
/>

### Passwork 2FA app

If your Passwork server is connected to the Internet and you wish to log into Passwork in one tap, choose the Passwork 2FA option and scan the QR code using the app.

If the application is not yet installed on your mobile device, you can get it from [<b>App Store</b>](https://apps.apple.com/us/app/passwork-2fa/id1632066067) or [<b>Google Play</b>](https://play.google.com/store/apps/details?id=com.passwork.authenticator)

<ImageComponent
  src="/img/assets/2fa-4.png"
  alt="Passwork 2FA app — scan QR code"
  format="regular"
/>

### Third-party TOTP app (Google Authenticator, Microsoft Authenticator, etc.)

Select **One-time password**, then scan the QR code using your authenticator app. Enter the 6-digit code shown in the app to confirm the connection.

<ImageComponent
  src="/img/assets/2fa-5.png"
  alt="TOTP setup — QR code scan"
  format="regular"
/>

## Connect a hardware security key or biometrics

Passwork supports WebAuthn-compatible devices, including physical security keys (YubiKey, FIDO2) and biometric authentication (fingerprint, Face ID).

In the **Biometrics and security keys** section, click **Add** and follow the on-screen instructions.

<ImageComponent
  src="/img/assets/2fa-6.png"
  alt="Adding a security key or biometric factor"
  format="regular"
/>

## Managing your 2FA connection

After 2FA is set up, you can:
- Enable or disable 2FA temporarily (if your organization's policy allows it)
- Remove the connected method and replace it with a new one
- Set up a new connection

<ImageComponent
  src="/img/assets/2fa-7.png"
  alt="2FA management panel"
  format="regular"
/>

For full 2FA documentation, see [Two-factor authentication](https://passwork.pro/user-guides/your-account/authentication/two-factor-authentication/).

---

## Passkeys — passwordless sign-in

In addition to 2FA, Passwork supports **passkeys**: a modern, phishing-resistant authentication method that replaces the password entirely. A passkey uses your device's biometrics (Face ID, Touch ID, Windows Hello) or a physical security key (YubiKey, FIDO2) to verify your identity.

:::info
Passkeys as a sign-in method must be enabled by your administrator in your role settings. If you do not see the option below, contact your IT administrator.
:::

### Add a passkey

1. Go to **Account settings → Authentication**.
2. Click the lock icon to unlock the page for editing.
3. In the **Passkey** section, click **Add**.

<ImageComponent
  src="/img/assets/sign-in-methods-3.png"
  alt="Add passkey button in Authentication settings"
  format="regular"
/>

4. Follow the system prompt to register your device's biometric sensor or physical security key.

Once added, you can sign in to Passwork by clicking **Sign in with passkey** on the login page — no password required.

### Manage passkeys

You can add multiple passkeys — for example, one on your laptop and one on a physical security key stored securely. If you lose access to one, you can sign in with another without needing an administrator reset.

<ImageComponent
  src="/img/assets/sign-in-methods-4.png"
  alt="Passkey management — rename and delete"
  format="regular"
/>

For full documentation, see [Sign-in methods](https://passwork.pro/user-guides/your-account/authentication/sign-in-methods/).

## Next step

Proceed to [Basic operations](./basic-operations.mdx) to save your first password and use autofill.