How do I turn on two-factor login?

Why use it

With multi-factor authentication (MFA), a stolen password isn't enough to log in: the attacker also needs your phone, security key or email. It is built into Joomla.

Set it up for your account

1. Log in to the administrator and open your profile (user menu → Edit Account).
2. Open the Multi-factor Authentication tab and click Add next to a method.
3. Choose Verification Code (an authenticator app), Web Authentication (a passkey or security key), YubiKey, or Authentication Code by Email.
4. Follow the steps, then save your backup codes somewhere safe.

Require it for a group

In Users → Manage → Options, the Multi-factor Authentication section lets you require MFA for groups such as Administrator and Super Users.

Good to know

• Only the account owner can set up MFA; an administrator can't do it for someone else.
• Passwordless login with passkeys is also built in (System - WebAuthn Passwordless Login).