# Multi-factor authentication **URL:** \ **Category:** Ideas\ **Tags:** šŸš¢-shipped\ **Created:** [April 2, 2018, 4:19pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548 "2018-04-02T16:19:43Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![ted\_roger](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@ted\_roger](https://forum.ghost.org/u/ted_roger)\ **Post date:** [February 7, 2023, 9:38am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/22 "2023-02-07T09:38:09Z")
MFA will be the best choice for security concerns. I hope in the future we will have this feature in Ghost. [šŸ„°](https://balloonslane.com/nyc-balloons/) ---
**Author:** ![Itchy](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/itchy/32/23751_2.png) [@Itchy](https://forum.ghost.org/u/Itchy)\ **Post date:** [March 25, 2023, 12:18pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/23 "2023-03-25T12:18:53Z")
Why is this still not implemented? Itā€™s been 5 years since it was first suggested. Weā€™re handling peopleā€™s private personal and payments data. EDIT: so this comment was apparently close to violating the Code of Conduct. I have been told I should make ā€œsuggestions with sourcesā€, so here we go. Clearly MFA is necessary. I donā€™t have to explain why. If the Devs didnā€™t want to implement it 5 years ago because there was no open source implementation available (totally understandable) there are now. I found [PrivacyIDEA](https://github.com/privacyidea), an open source and apparently free MFA project. It supports many forms of authentication, including HOTP / TOTP (One Time Passwords), email tokens, SMS (nobody should use this but itā€™s there), WebAuthn, U2F, Password Tokens, Yubikeys and NitroKeys, and more. When I have got a stable build of my website Iā€™ll be attempting to implement OTPs and Yubikey auth, Iā€™ll let you know how it goes. Alternatively, there is [Ory](https://github.com/ory), which offers the same range of open source auth solutions to build on your site and a hosted service if you donā€™t want to host it yourself (itā€™s about $30 for 1000 users a month). @kerryhatcher I know itā€™s been 3 years but do you still want to help? Does anyone else want to try implement some of these and see how they work? Iā€™m not very experienced with Node.js (Python for me!) so my progress will probably be quite slow. If anyone wants to help, I would appreciate it. I think everyone here needs the security and if we can get a workable, open source solution running, the devs can add it to Ghost and keep everyone safe. Let me know what you think and if you want to help. Cheers. ---
**Author:** ![satonotdead](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/satonotdead/32/33666_2.png) [@satonotdead](https://forum.ghost.org/u/satonotdead)\ **Post date:** [March 28, 2023, 2:33am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/24 "2023-03-28T02:33:28Z")
Is that a real limitation to implementing **some** MFA thatā€™s mandatory for every project that supposed to be secure on internet? Are you still thinking on that on 2023? I can live without SSO (because there are devs around there) and I can bought a theme (two really). But I canā€™t open to the world my collaborative projects without MFA. ---
**Author:** ![pureflo](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/pureflo/32/35694_2.png) [@pureflo](https://forum.ghost.org/u/pureflo)\ **Post date:** [June 24, 2023, 8:12am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/26 "2023-06-24T08:12:52Z")
We will be hopeful. > [@Leveraging 3rd party sign-in](https://forum.ghost.org/t/leveraging-3rd-party-sign-in/25653): > > Hello wave Ghost community, Iā€™ve spent a bit of time clicking through this great community and Iā€™m specifically searching for some thoughts/ideas/solutions to this one burning question. Can Ghost use an external party for sign-on for subscribers? My use case. Allow subscribers the ability to sign up/sign in with 3rd party credentials - Iā€™m thinking services similar to [Auth0](https://auth0.com). Hoping this will also allow the user to seamlessly move to other services within my control, such as a forum, with tā€¦ ---
**Author:** ![agam](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/agam/32/16469_2.png) [@agam](https://forum.ghost.org/u/agam)\ **Post date:** [August 15, 2023, 11:09am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/27 "2023-08-15T11:09:48Z")
I would really like to secure my newsletter login with 2FA. Many hacks nowadays are stopped by such mechanisms. ---
**Author:** ![stuartbreckenridge](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/stuartbreckenridge/32/7264_2.png) [@stuartbreckenridge](https://forum.ghost.org/u/stuartbreckenridge)\ **Post date:** [September 21, 2023, 10:36pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/28 "2023-09-21T22:36:40Z")
I would like to see Passkeys implemented. ---
**Author:** ![Paul2](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/paul2/32/24156_2.png) [@Paul2](https://forum.ghost.org/u/Paul2)\ **Post date:** [October 1, 2023, 9:20pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/29 "2023-10-01T21:20:35Z")
Is there any update or official update from Ghost in regards to if 2FA/MFA feature is being worked on? ---
**Author:** ![Darkice2](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/darkice2/32/20459_2.png) [@Darkice2](https://forum.ghost.org/u/Darkice2)\ **Post date:** [November 26, 2023, 3:06pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/30 "2023-11-26T15:06:06Z")
I know there is already a thread, but wanted to express that MFA should be without question the top priority for new features. No plugins ā€“ MFA built in to the product like any other app. I cannot even think of a single other app I use that doesnā€™t have MFA. I love Ghost but this really confuses me how this could be left out of development. Also, it definitely costs Ghost money to not have MFA. I know several businesses that will not use Ghost simply because no MFA. I work in cybersecurity and MFA really isnā€™t optional in 2023. Businesses running ghost have compliance needs/etc and not having MFA on a production website looks bad + is insecure. Also, why no option to whitelist IPs that can login? A basic feature like this is literally an if statement comparing against a CIDR list of IP ā€“ guessing max time to implement 48 hoursā€¦ Having IP whitelist is a good option that is better than nothing until MFA is added. In short: the cost to develop is low (low effort/low cost), and money lost from businesses not buying b/c no MFA is likely high. ---
**Author:** ![joshuniverse](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joshuniverse/32/30150_2.png) [@joshuniverse](https://forum.ghost.org/u/joshuniverse)\ **Post date:** [January 24, 2024, 4:18am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/31 "2024-01-24T04:18:10Z")
We need this feature. Anti-bruteforce protection can only go to far and 2FA is designed to be a combination of something you know(which can be prone to phisihing and stuff) and something you have which tends to be less prone to phishing and increases security and is standard is most businesses. ---
**Author:** ![Zlatanera](https://avatars.discourse-cdn.com/v4/letter/z/4da419/32.png) [@Zlatanera](https://forum.ghost.org/u/Zlatanera)\ **Post date:** [February 19, 2024, 10:52am UTC](https://forum.ghost.org/t/multi-factor-authentication/548/32 "2024-02-19T10:52:15Z")
Any updates here? ā€¦also voting 2FA up! This is an essential feature thatā€™s missing. ---
**Author:** ![Darkice2](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/darkice2/32/20459_2.png) [@Darkice2](https://forum.ghost.org/u/Darkice2)\ **Post date:** [May 11, 2024, 8:19pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/33 "2024-05-11T20:19:04Z")
It is honestly really bad to still have no MFA option at all. I know 3 companies (make millions of dollars) that will not use Ghost because no MFA. Basically trying to lose money by not having this. It would probably take 4-5 hours of work max to implement something basic like Email Only MFA and an option to Whitelist which IP ranges can login to accountā€¦ very confusing to me that this isnā€™t done yet ---
**Author:** ![thorin](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@thorin](https://forum.ghost.org/u/thorin)\ **Post date:** [August 22, 2024, 3:21pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/34 "2024-08-22T15:21:36Z")
Just started using Ghost a couple of weeks ago and I am very impressed by it. The one thing I am curious about is how Multi-Factor authentication is not a feature/required on the /ghost admin page. I also understand that there is brute force protection, I believe the limit is 5 per hour by IP, but MFA is a critical security feature for any platform to have nowadays. ---
**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\ **Post date:** [October 8, 2024, 2:12pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/35 "2024-10-08T14:12:56Z")
Commits related to this are starting to appear. > Still in the alpha stage. Nothing to test yet. ---
**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\ **Post date:** [October 8, 2024, 2:23pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/36 "2024-10-08T14:23:35Z")
Glad Iā€™m not the only one who likes github spying. :) ---
**Author:** ![Spectre1](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@Spectre1](https://forum.ghost.org/u/Spectre1)\ **Post date:** [October 8, 2024, 2:28pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/37 "2024-10-08T14:28:27Z")
Nice, thanks for the reminder that I had forgot to ā€œwatchā€ the Ghost repos šŸ˜ƒ ---
**Author:** ![Zlatanera](https://avatars.discourse-cdn.com/v4/letter/z/4da419/32.png) [@Zlatanera](https://forum.ghost.org/u/Zlatanera)\ **Post date:** [December 6, 2024, 2:47pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/38 "2024-12-06T14:47:25Z")
As far as I can tell, the 2fa might be integrated soon as a beta feature? > We would love to see that! ---
**Author:** ![sheldrake](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sheldrake/32/18522_2.png) [@sheldrake](https://forum.ghost.org/u/sheldrake)\ **Post date:** [March 12, 2025, 8:16pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/39 "2025-03-12T20:16:51Z")
Iā€™ve advised against Ghost for no other reason than it not having 2FA on too many occasions. Itā€™s OK for my little old blog but nothing more serious. Could this be the year Ghost gets into the last decade in this regard?!?! ---
**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\ **Post date:** [March 14, 2025, 8:38pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/40 "2025-03-14T20:38:26Z")
Itā€™s in now - I think around 5.110 or 5.11? ---
**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\ **Post date:** [April 10, 2025, 6:35pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/41 "2025-04-10T18:35:05Z")
2 posts were split to a new topic: [2FA auth slider is missing?](https://forum.ghost.org/t/2fa-auth-slider-is-missing/56734) ---
**Author:** ![joshuniverse](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joshuniverse/32/30150_2.png) [@joshuniverse](https://forum.ghost.org/u/joshuniverse)\ **Post date:** [April 10, 2025, 11:18pm UTC](https://forum.ghost.org/t/multi-factor-authentication/548/42 "2025-04-10T23:18:31Z")
No, I do not see it? (Using Ghost Self Hosted version **Version:** [5.116.1](https://github.com/TryGhost/Ghost/releases/tag/v5.116.1)) Can you send a screenshot of this 2FA slider? I would loveeee to use it! Thank you [Previous page](https://forum.ghost.org/t/multi-factor-authentication/548.md?page=1) [Next page](https://forum.ghost.org/t/multi-factor-authentication/548.md?page=3)