---
id: django-two-factor-auth
version: "1.18.1"
license: MIT
license_treatment: permissive
maintenance: active
---

# django-two-factor-auth — Complete Two-Factor Authentication for Django

License: permissive · Maintenance: active · Downloads: 3.1M/mo

## What it is and what it does

Django Two-Factor Authentication is a complete 2FA solution built on top of Django's authentication framework and the django-otp one-time password library. It integrates seamlessly into existing Django projects and lets users authenticate through multiple channels: one-time passwords (TOTP), SMS text messages, voice calls, token generator apps like Google Authenticator, or hardware tokens such as YubiKey.

The package handles the full authentication flow, from user enrollment through verification, and is designed to mirror the user experience of Google's Two-Step Authentication. It includes support for multiple languages and works with Django 4.2 through 5.1 on Python 3.9–3.13. An example app is available for testing most features, and documentation is comprehensive.

Use it for:

- Add SMS or call-based 2FA to a Django web application for user account security.
- Integrate TOTP-based authentication (Google Authenticator, Authy) into an existing Django login flow.
- Support hardware security keys (YubiKey) for high-security user accounts.
- Build a multi-channel authentication system where users choose their preferred 2FA method.
- Enhance Django admin or staff portals with mandatory two-factor verification.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Adds complete two-factor authentication to Django projects, supporting authentication via one-time passwords, SMS, call, token generator apps, and hardware tokens like YubiKey.

Yes. This is a mature, actively maintained package (1876 GitHub stars, recent commits) with no known vulnerabilities, low install friction, and permissive licensing. It solves a critical security problem for Django projects and integrates cleanly with Django's built-in auth framework. Use it when you need production-grade 2FA for a Django application.

## Install

pip install django-two-factor-auth
uv add django-two-factor-auth
poetry add django-two-factor-auth

## Installing django-two-factor-auth

Before you install: Low friction installation with a pure-Python wheel. Active maintenance with recent commits and no known vulnerabilities. Supports current Django versions (4.2, 5.0, 5.1, 5.2) and Python 3.9–3.13.

License in practice: MIT license is permissive; you can use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions.

Quickstart:

pip install django-two-factor-auth

from django_otp.plugins.otp_totp.models import StaticDevice
from django_two_factor_auth.views import LoginView

# Add to Django settings.INSTALLED_APPS:
# 'django_otp',
# 'django_two_factor_auth',

Requires Django 4.2+ and Python 3.9+. Depends on django-otp, qrcode, django-phonenumber-field, and django-formtools as runtime dependencies.

Verify before relying:

- Whether Twilio SMS integration is fully functional or requires additional setup beyond the package itself.
- Performance characteristics when handling high volumes of authentication requests.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 3.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django two-factor authentication, 2fa for django, otp authentication django, django security authentication, multi-factor auth django, django yubikey support, django sms authentication, authentication, django-plugin, security

[View on SkillFed](https://skillfed.io/packages/django-two-factor-auth) · [View on PyPI](https://pypi.org/project/django-two-factor-auth/)