Two-Factor Authentication (TOTP): A second factor with its secret encrypted at rest
Standard TOTP two-factor authentication, with the secret itself encrypted at rest - not just the password it’s protecting.
How do you turn on two-factor sign-in?
DenwaysMeet supports standard TOTP two-factor sign-in. Turn it on from Settings → Security with any authenticator app, such as Google Authenticator, Authy or 1Password. Scan the code and confirm it once. It’s then required on every sign-in.
- Works with any standard TOTP authenticator app
- Your TOTP secret is encrypted at rest with AES-256-GCM, not stored in plain text
- Recovery codes are Argon2-hashed and single-use
Why is the secret encrypted rather than hashed?
The server needs the secret itself to check each code, so it can’t be hashed the way a password is. DenwaysMeet encrypts it at rest with AES-256-GCM instead. A copy of the database alone doesn’t hold usable secrets in plain text.
How is your password stored?
Your password is never stored or logged in plain text. It’s hashed with Argon2id, the current recommended standard, before it ever touches disk. Two-factor sign-in adds a second check on top of it.
Can an organization require two-factor sign-in?
Yes. A two-factor requirement sits in the organization’s settings, next to its logo and brand color. Use it when every member of the organization should sign in with a second factor, not just those who chose to.
What protects you if you lose your authenticator?
You can sign in with a recovery code. Each one works once, and each is stored as an Argon2 hash.
How are sessions and Google sign-in secured?
Sessions are cookie-based and server-side, with hashed tokens. Where Google sign-in is configured, it uses the full OAuth 2.0 PKCE flow with ID-token verification.
Keep reading
Bring the whole conversation together.
Set up a workspace in a couple of minutes. Free for up to 5 members, no credit card required.
