Book a demo
MFA and one-time codes

Multi-factor authentication where it matters, and one-time codes nobody has to type.

My1Login asks for a second factor before it releases a password or a single sign-on to the apps you choose, using authenticator apps and the biometrics on people's own phones. And when an app asks for an authenticator code, My1Login generates it and fills it in, so the whole sign-in happens without anyone typing.

Book a 5-minute demoSee pricing
What J. Morgan sees: One touch, then Payroll opens.
  • Authenticator appstime-based one-time codes
  • Biometricsfingerprint, face, voice or pattern on the phone
  • Step-upconfirm the directory sign-in again
  • Code auto-fillauthenticator codes filled in for you

Most MFA is either everywhere or nowhere.

A second factor on every sign-in wears people down, while apps with no MFA of their own get no protection at all. My1Login asks for a check where the risk is, and takes one-time codes off people's hands completely.

A typical MFA rollout

  • The same challenge for every app, every time
  • Apps without built-in MFA get no second factor
  • Codes typed in by hand, every time
  • Another app for everyone to install and learn

MFA with My1Login

  • Checks only where your policy says: by user, group, app, location or network
  • A check before any app's password or single sign-on is released
  • Authenticator codes generated and filled in automatically
  • Uses authenticator apps and the biometrics on people's phones

Multi-factor authentication, from policy to sign-in.

Follow one sensitive app from the moment IT sets its policy to the moment someone signs in. IT sets the rules at every step, and your workforce only sees a check when the policy asks for one.

  1. 1Policy setWho, what, where
  2. 2Factors chosenApps and biometrics
  3. 3CheckedStep-up and MFA
  4. 4Code filled inOne-time passwords
  5. 5LoggedAudit trail
Step 1 · Policy set

Decide where a second factor is worth asking for.

Set application-specific policies that ask for a step-up or multi-factor check only when it's needed. Each policy can depend on the user, their group, the application, whether they're on or off your premises and their IP location.

  • Security without slowing people down. Low-risk sign-ins in the office go straight through.
  • Stricter for what matters. Payroll, finance and admin accounts can always ask for a check.
Step 2 · Factors chosen

Use the factors your workforce already has.

My1Login works with authenticator apps and with the biometrics on people's own phones: fingerprint, face, voice or touch pattern. For a lighter check, it can simply ask people to confirm their directory sign-in again.

  • Nothing new to hand out. Most people already carry a phone with an authenticator app or biometrics.
  • Protects My1Login too. The same methods protect access to My1Login and the credentials stored in it.
Step 3 · Checked

A check before the password is released.

When someone opens an app covered by a policy, My1Login asks for the step-up or second factor before it releases the password or the single sign-on. That protects apps that have no MFA of their own, because the sign-in only happens once the check is passed.

  • Step-up or full MFA. Ask people to confirm their directory sign-in, or to pass a second-factor challenge.
  • One touch on a phone. A fingerprint or face is enough when your policy allows it.
Step 4 · Code filled in

One-time codes, filled in for you.

When an app asks for an authenticator code, My1Login generates it and fills it in during the sign-in. Combined with single sign-on, the whole sign-in is automated: username, password and code, with nobody opening an app to read a number. Apps that send codes by text or email can usually be set to use authenticator codes instead, so those can be filled in too.

  • Built for codes that slow people down. Including government and supplier portals that ask for a code every time. Government Gateway auto-login
Step 5 · Logged

A record of who signed in, and how.

The audit trail shows who opened which app and when, and every MFA check and its result is recorded alongside it, so compliance reviews and investigations can see that sensitive apps were protected.

  • Ready-made and custom reports. For audits, access reviews and incident response.
Better together

Combine it with single sign-on for a sign-in nobody types.

Single sign-on fills in the username and password, MFA checks it's really them, and the one-time code is filled in automatically.

See single sign-on for web

And the details that make it work.

  • Zero Login

    Signing in to your corporate directory signs your workforce in to My1Login automatically.

  • Zero UI

    No new screens. People only see a check when the policy asks for one.

  • Hidden passwords

    Combined with hidden passwords, there's no password to phish, and the second factor stops anyone else using the account.

  • On and off premises

    Policies know whether people are in the office or working remotely, and where they're signing in from.

  • Codes shared with a team

    One account, one code, many people. My1Login generates the code and fills it in for everyone allowed to use the account, so it never depends on one person's phone. Many password managers can't share codes at all.

  • Signed in, no extra clicks

    My1Login fills in the username, password and code and submits them, so people aren't clicking through each step. Password managers that fill in codes usually still leave that to the user.

  • Apps asking for codes, found

    My1Login spots the cloud apps where people are being asked for one-time codes, so IT can see where MFA is in use and bring those apps under policy.

  • Evidence for compliance audits

    Which apps ask for codes, who signed in and when, reported in one place: the central record auditors ask for.

Zero-knowledge encryption

We can't read your passwords. Nobody outside your organization can.

The keys that unlock your stored passwords are only available inside your organization's own network. What My1Login stores is encrypted and unreadable to anyone outside it, and that includes us.

Where the encryption keys are kept Your organization's network holds the encryption keys and your workforce's sign-ins. Only encrypted passwords travel to and are stored in the My1Login service, which has no keys and cannot read them. YOUR ORGANIZATION'S NETWORK Encryption keys Only ever here Your workforce Signed in to their apps encrypted MY1LOGIN SERVICE Encrypted passwords No keys here, so nobody at My1Login can read them

Independently recognized

  • KuppingerCole Leadership Compass 2025My1Login featured in the Privileged Access Management report
  • SC Awards Europe 2025, winnerBest Identity and Access Management Solution
  • Cyber Essentials PlusCertified. Penetration tested by CREST-approved testers: rated A+ and suitable for use in defense
Trust centerSecurity overview (PDF)

Part of one platform, with one policy and one log.

MFA and one-time codes share their directory connection, policies and audit trail with the rest of My1Login.

More on MFA and one-time passwords

MFA and one-time password questions

What is multi-factor authentication?

Multi-factor authentication (MFA) asks people to prove who they are in more than one way, for example a password plus a fingerprint or an authenticator code. With My1Login, the check happens before a password or single sign-on is released to an app.

Can MFA apply to some apps and not others?

Yes. Policies are set per application and can depend on the user, their group, whether they're on or off your premises and their IP location, so people only see a check where the risk calls for one.

Which second factors does it work with?

Authenticator apps and the biometrics on people's phones (fingerprint, face, voice or touch pattern). Policies can also ask people to confirm their directory sign-in again as a step-up.

How does one-time code auto-fill work?

My1Login generates time-based authenticator codes, the kind an authenticator app shows, and fills them in when an app asks for one during sign-in. Most apps that send codes by text or email can be set to use authenticator codes instead, so those can be filled in too.

Can it protect apps that don't have MFA built in?

Yes. Because My1Login only releases the password or single sign-on after the check is passed, apps with no MFA of their own are protected too.

Can My1Login see our passwords?

No. With zero-knowledge encryption the keys are only available inside your organization's network, so nobody outside it can read your stored passwords, including My1Login.

What does the adoption guarantee cover?

Adoption is guaranteed wherever the zero-login configuration has been deployed. Every provisioned user who signs in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term counts as adopted. Signing in to the directory signs them in to My1Login automatically, so your workforce doesn't have to enroll in or open My1Login.

How much does it cost?

Our pricing page has current prices and plans. See pricing

Bring your most demanding sign-in to a 5-minute demo.

We'll set a step-up policy and fill in a one-time code while you watch, then show you what your workforce sees: one touch, and the app opens.

  • 5 minutes, on your own apps
  • A specialist replies within one working day
  • No obligation
Book a 5-minute demoStart a 14-day free trialThe full product, on your own apps.
Book a 5-minute demoFree trial