Multi-factor authentication

ThreatAuthenticator

Adds a second verification layer to corporate accounts: mobile approval, one-time passcodes and Windows sign-in.

4: authentication methods
Push + TOTP + QR: software-based factors
Android: on Google Play (after review)
Windows logon: credential provider integration

Why it matters

Password-only login is unsafe — hackers steal them.

Passwords are cracked, leaked into breaches, written on whiteboards. But a second factor — your phone, your computer — makes it hard even for attackers who have the password. Getting past two gates becomes exponentially harder and this often stops attackers in their tracks. Second-factor authentication is one of the most cost-effective layers of security defense.

How many accounts in your company, especially admin accounts, rely on password-only software login?
If your password leaks, does an attack start immediately or is there a block?
For critical operations (file deletion, permission change) is a second confirmation required?

What it does

What it does.

TOTP — time-based code

An app on your phone generates a six-digit code that changes every 30 seconds. No internet required for generation or verification — works even offline.

Push notification

When you try to log in, a notification goes to your phone saying "Logging in: Chrome". You tap approve — only you can tap it.

QR code pairing

Scan a QR code from the admin panel; your phone parses it and auto-configures. When you change phones, scan a new QR — each phone keeps its own key.

Recovery keys

If you lose your phone, you can log in with a 10-digit recovery key. Each key works once. Keys are shown in the admin panel and unexpected usage is logged.

Groups and policies

Organize users into groups; tell finance that QR verification is required, but marketing can use TOTP. Policies are company-specific.

Resource definition

Operating system, email, cloud app, website — you define which systems need verification as resources and can set a different policy for each.

Windows computer login

At the Windows logon screen, you enter your phone's TOTP code instead of your computer password and log in. This secures the physical machine even if you don't use Azure AD.

User sync and AD integration

Automatically pull users from Active Directory with group membership preserved. LDAP also works — synchronized with your corporate file server's user list.

How it works

From setup to report.

01
Install the app

Download Android APK or Link from the admin panel and install it on your phone. The app is in Google Play Store review — once approved it can be installed from there too.
02
Link your account

Create a new user or migrate an existing one from the admin panel. A QR code appears.
03
Scan the QR on your phone

Open the app on your phone and scan the QR from the panel. Your phone automatically loads the correct settings and generates the first code.
04
Define policy

Say what kind of verification is needed on each resource (Windows, web, cloud) — is TOTP enough or is QR/push also required, does it differ by group.
05
Log in and verify

Try to access the system; a push goes to your phone or you are asked for a code. Once verified, the system grants access and a notification fires.

Technical details

The specifics.

Authentication methods: TOTP (6 digits, 30 sec), Push notification (approve button), QR code scan (pairing), Recovery key (10 digits, single use)
Mobile app: Android (Flutter), iOS not available (not planned)
Windows logon: Credential provider, Windows 10+ (domain-joined)
User source: Active Directory, LDAP, manual add
Resources: Operating system, email, website, cloud app, API — each resource can have its own verification rules
Groups and policy: Group management with per-group authentication policies
Reporting: Successful/failed login records, recovery key usage, device and account information

FAQ

Frequently asked questions.

What if I lose my phone?

Your recovery keys are saved in the admin panel. You can use one to log in. Once in the panel, you can reset your account and set up a new phone. Unexpected key usage is logged.

Was my TOTP code rejected as wrong?

The code changes every 30 seconds. If you enter it too late it may be rejected. Your phone clock may differ from your computer clock — just a few seconds apart. Check your phone time. If there is no push, you can log in with a recovery key.

Can accounts without second factor be managed?

Yes. Policy is set per-group — you say 'Finance group requires second factor', another group does not. You might not want second factor mandatory at the start — you control this in policy.

Related services