---
title: "Two-factor authentication"
description: "**Two-factor authentication (2FA)** is a way to make your login to ChurchTools even more secure. In addition to entering your password, this authentication requires you to enter a six-digit confirmation code, which is generated in a suitable app (e.g. [Google…"
url: "https://staging.churchtools.academy/en/help/my-churchtools/register-and-log-in-en/22-two-factor-authentication/"
updated: "2026-04-15"
category: Register and log in
---

# Two-factor authentication

**Two-factor authentication (2FA)** is a way to make your login to ChurchTools even more secure.
In addition to entering your password, this authentication requires you to enter a six-digit confirmation code, which is generated in a suitable app (e.g. [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&pli=1) or [FreeOTP Authenticator](https://apps.apple.com/de/app/freeotp-authenticator/id872559395) ).

## Activation for your own user account

You can activate the two-factor authentication for your own user account in your *profile* and then follow the instructions for setting it up.

![](https://staging.churchtools.academy/wp-content/uploads/2023/12/image.png)

 

**Tip**

If you change your smartphone, switch off 2FA in your profile beforehand. Then log in to ChurchTools with your new smartphone and set up 2FA again. You do not need to change your password.

## Enforced by the admin for certain user accounts

If you are an admin of your ChurchTools, you can force the two-factor authentication for certain users, provided you have the administration permission `administer persons` or `simulate persons`. This is useful if a person has a lot of permissions and their user account should be better protected.

### Enforced for individual persons

As an admin you can set up the two-factor authentication to be required for each person separately. This is done in **Persons & Groups**, where you click on the pencil next to *Permissions* in the person detail view. A window will now open and you can select *Enforce two-factor authentication*. The next time the person logs in, they will be asked to set up 2FA.

### ![](https://help.church.tools/images/158986/4362e67d11bc34f37642b2d8caf166236c6fa3ca18406e7d2c86253ae882b233?fit=max&fm=png&h=0&w=940)
Enforce for certain roles in a group

You can also link the enforcement of the two-factor authentication to specific roles in a single group. To set this up, go to **Persons & groups** and click on *Configure roles* on the right-hand side of a group.

![](https://staging.churchtools.academy/wp-content/uploads/2023/12/image-1.png)

Now you can decide for each role in this group whether the *two-factor authentication should be enforced*.

## ![](https://help.church.tools/images/158992/28069cd9496c591a7b0f1298580dfa4160aeb032f2cf8a96593f7aa85a9697c1?fit=max&fm=png&h=0&w=940)
Filter two-factor authentication

As an admin with the `administer persons` permission, you can use *More filter* in the **Persons & groups** module to filter for which user accounts 2FA is activated and for which it is not yet activated.

![](https://help.church.tools/images/158995/df85f61550246cabb211970063c4de97dc280cff7f54a2376065d5a7e6439c7e?fit=max&fm=png&h=0&w=940)