# 2FA - do we have to do anything to enable it?

**URL:** https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609
**Category:** Support
**Tags:** 2fa
**Created:** [August 13, 2018, 3:55pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609 "2018-08-13T15:55:27Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [August 13, 2018, 4:09pm UTC](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609/4 "2018-08-13T16:09:19Z")

</div>

I don’t believe it can be disabled, no. Also, no data is being sent to a third party.

Here’s a quick summary of 2FA: Discourse implemented the TOTP (time-based one time password) algorithm. When a user decides to enable 2FA they are presented with a QR code (or a long string of characters). That string is used by an authentication app (like Google Authenticator, Microsoft Authenticator, Authy, YubiKey, etc.) to generate a new 6-digit password every 30 seconds. Those apps are in no way connected to your Discourse site, nor do they have any user info. They simply generate a code every 30 seconds. Your Discourse site also knows what those codes are, so when a user tries to log in, after entering their username and password they’re asked for a code. They check their app, enter the code, and the server checks if it’s the same code it expected.

Does that make sense?

---

_[View the full topic](https://meta.discourse.org/t/2fa-do-we-have-to-do-anything-to-enable-it/94609)._