Brain 2FA

Brain 2FA protects WordPress accounts with a second authentication factor. After entering their password, users confirm their identity with a six-digit code from an authenticator app or from their email inbox.

Codes are generated and verified on your own server. Brain 2FA does not send any data to third-party services.

Features

• Authenticator apps (TOTP): Works with Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and any other TOTP-compatible app. Users set it up by scanning a QR code or entering the secret key manually.
• Email verification codes: Sends a one-time code to the account email address, with a configurable expiry time.
• Recovery codes: TOTP users receive one-time recovery codes they can download and regenerate in case they lose their phone.
• Role-based enforcement: Require two-factor authentication for selected user roles, such as Administrator, Editor or Shop manager.
• Setup grace period: Give users in required roles a set number of days to enable 2FA. Administrators can see deadlines in the Users list and extend them from a user’s profile.
• Trusted devices: Users can optionally skip the code on devices they trust, using expiring, password-hashed tokens.
• Consistent enforcement: The 2FA policy applies to every sign-in, including direct submissions of the login form, not only the JavaScript-assisted flow. The credential check before the code step is rate limited per IP address.
• WooCommerce support: Works with the default WordPress login form and the WooCommerce My Account login form.
• Translation ready: All user-facing text can be translated.

Support

Need help? Visit Braintum Support.

Development

The development source code and build tools for Brain 2FA are publicly available at:
https://github.com/Braintum/brain-2fa

The JavaScript files in assets/js/ are generated from the source files in src/js/.