---
title: "Offer two-factor login · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login
updated: 2026-10-20
licence: "All rights reserved"
---

# Offer two-factor login

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Offer a second factor to every user, and require it for staff and admin accounts. Prefer passkeys, which phishing cannot steal.
- How: Support passkeys (WebAuthn) or an authenticator app for customers. Staff and admins use phishing-resistant factors only, which means passkeys or security keys, as NIST SP 800-63B-4 and CISA advise. Avoid text messages where you can, because numbers can be hijacked. Rate limit code entry, give one-time recovery codes, and ask again for the second factor before changing it. See also [give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes) and [plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors).
- Check: Log in as a test admin with only the password. Access is refused until the second factor is given, and an authenticator app code is not accepted for admins. Ten wrong codes in a row are slowed or blocked.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login`.

- Previous: [Verify every token](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks)
- Next: [Compare secrets in constant time](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/constant-time-compare)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)