Django-mfa (Multi Factor Authentication) is a simple package to add extra layer of security to your django web application. It gives web app a randomly changing password as an extra protection.
Clone or download
gregkster and ashwin31 Improved security of remember-my-browser cookie (#32)
* Make it work with Django 2.0.7

* No need to specify the namespace when including django-mfa urls

* Once MFA is successfuly enabled redirect to LOGIN_REDIRECT_URL
Pass optional settings.MFA_ISSUER_NAME to the Authenticator app via QR code

* Added remember-my-browser, a feature allowing to use cookie to remember that
a code has already been entered successfully on a browser and not ask again
for a defined number of days

* Use redirect to LOGIN_REDIRECT_URL instead of HttpResponseRedirect to support
both url path and urlpattern name

* Don't set the remember-my-browser cookie when MFA is enabled.  Make the user
enter the code on next login
Set cookie secure flag based on DEBUG

* Delete the remember-my-browser cookie when disabling MFA

* Fixed required django version in to >=1.10
Formatting fix in Readme.rst

* Using a fixed salt for Remember-my-browser cookie signing is insecure.
Better to use different salt for different users.  Derive the salt from user's
OTP secret.

* changed python to 3.5

* removed test cases temp
Latest commit 274e9d6 Jan 1, 2019



Documentation Status Latest Release Code Health

Django-mfa(Multi-factor Authentication) is a simple django package to add extra layer of security to your web application. Django-mfa is providing easiest integration to enable Multi factor authentication to your django applications. Inspired by the user experience of Google's Authentication, django-mfa allows users to authenticate through text message(SMS) or by using token generator app like google authenticator.

We welcome your feedback on this package. If you run into problems, please raise an issue or contribute to the project by forking the repository and sending some pull requests.

This Package is compatible with Django versions >=1.10 (including at least Django 2.0.7) Documentation is available at readthedocs(

Quick start


The Git repository can be cloned with this command:

git clone

The django_mfa package, included in the distribution, should be placed on the PYTHONPATH.

Otherwise you can just easy_install -Z django-mfa or pip install django-mfa.


  1. Add app name in

  2. Add 'django_mfa.middleware.MfaMiddleware' to your project middlewares:

  3. Optional issuer name. This name will be shown in the Authenticator App along with the username

    MFA_ISSUER_NAME = "Cool Django App"

  4. Optionally enable remember-my-browser. If enabled, the browser will be trusted for specified number of days after the user enters the code once:



Add the following to your root file.

urlpatterns = [

    url(r'^settings/', include('django_mfa.urls')),

Done. With these settings you have now, you will get the MFA features.

You can try it by hosting on your own or deploy to Heroku with a button click.

Visit our Django web development page Here

We welcome your feedback and support, raise github ticket if you want to report a bug. Need new features? Contact us here