django-two-factor-auth

What it is and what it does

Django Two-Factor Authentication is a complete 2FA solution built on top of Django's authentication framework and the django-otp one-time password library. It integrates seamlessly into existing Django projects and lets users authenticate through multiple channels: one-time passwords (TOTP), SMS text messages, voice calls, token generator apps like Google Authenticator, or hardware tokens such as YubiKey.

The package handles the full authentication flow, from user enrollment through verification, and is designed to mirror the user experience of Google's Two-Step Authentication. It includes support for multiple languages and works with Django 4.2 through 5.1 on Python 3.9–3.13. An example app is available for testing most features, and documentation is comprehensive.

Use it for:

• Add SMS or call-based 2FA to a Django web application for user account security.
• Integrate TOTP-based authentication (Google Authenticator, Authy) into an existing Django login flow.
• Support hardware security keys (YubiKey) for high-security user accounts.
• Build a multi-channel authentication system where users choose their preferred 2FA method.
• Enhance Django admin or staff portals with mandatory two-factor verification.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds complete two-factor authentication to Django projects, supporting authentication via one-time passwords, SMS, call, token generator apps, and hardware tokens like YubiKey.

Yes. This is a mature, actively maintained package (1876 GitHub stars, recent commits) with no known vulnerabilities, low install friction, and permissive licensing. It solves a critical security problem for Django projects and integrates cleanly with Django's built-in auth framework. Use it when you need production-grade 2FA for a Django application.

Install

django-two-factor-auth on PyPI

pip install django-two-factor-auth

uv add django-two-factor-auth

poetry add django-two-factor-auth

Installing django-two-factor-auth

Before you install

Low friction installation with a pure-Python wheel. Active maintenance with recent commits and no known vulnerabilities. Supports current Django versions (4.2, 5.0, 5.1, 5.2) and Python 3.9–3.13.

License in practice

MIT license is permissive; you can use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions.

Quickstart

pip install django-two-factor-auth

from django_otp.plugins.otp_totp.models import StaticDevice
from django_two_factor_auth.views import LoginView

# Add to Django settings.INSTALLED_APPS:
# 'django_otp',
# 'django_two_factor_auth',

Requires Django 4.2+ and Python 3.9+. Depends on django-otp, qrcode, django-phonenumber-field, and django-formtools as runtime dependencies.

Verify before relying

• Whether Twilio SMS integration is fully functional or requires additional setup beyond the package itself.
• Performance characteristics when handling high volumes of authentication requests.

Package facts

Evidence: django_two_factor_auth-1.18.1-py3-none-any.whl

Keywords: django, two-factor

Tags

More Security packages