Two-factor authentication help
This page explains two-factor authentication on Wikimedia Foundation wikis. For documentation of the extension that adds this functionality, see mw:Extension:OATHAuth.
Wikimedia's implementation of two-factor authentication (2FA) is a way to strengthen the security of your account. If you enable two-factor authentication, you will be asked for a one-time six-digit authentication code every time in addition to your password. This code is provided by an app on your smartphone or other authentication device. In order to log in, you must know your password and have your authentication device available to generate the code.
Two-factor authentication on Wikimedia is currently experimental and optional (with some exceptions). Enrollment requires
(oathauth-enable) access, currently in production testing with administrators (and users with admin-like permissions like interface editors), bureaucrats, checkusers, oversighters, stewards, edit filter managers and the OATH-testers global group.
Wikitech LDAP accounts are also eligible.
Mandatory use user groups
Enabling two-factor authentication
- Have or install a Time-based One-time Password Algorithm (TOTP) client. For most users, this will be a phone or tablet application. Commonly recommended apps include:
- Password managers such as 1Password, LastPass, and KeePass also tend to support/have plugins to support TOTP. This bears the same limitations as the above, but may be worth looking into if you already use one for other things.
- Scan the QR code with, or enter the two-factor account name and key into, your TOTP client.
- Enter the authentication code from your TOTP client into the OATH screen to complete the enrollment.
- Provide your username and password, and submit as before.
- Enter in a one-time six digit authentication code as provided by the TOTP client. Note: This code changes about every thirty seconds.
Keep me logged in
If you choose this option when logging in, you normally will not need to enter an authentication code when using the same browser. Actions such as logging out or clearing the browser cache will require a code on your next login.
Some security sensitive actions, such as changing your email address or password, may require you to re-authenticate with a code even if you chose the keep-me-logged-in option.
You may use OAuth or bot passwords to restrict API sessions to specific actions, while still using two-factor authentication to protect your full access. Please note, OAuth and bot passwords can not be used to log on interactively to the website, only to the API.
For example, tools like AutoWikiBrowser (AWB) do not yet support two-factor authentication, but can use bot passwords. For further information on how to configure this see Wikipedia:Using AWB with 2FA
Disabling two-factor authentication
- On the disable two-factor authentication page, use your authentication device to generate a code to complete the process.
When enrolling in two-factor authentication, you will be provided with a list of ten one-time scratch codes. Please print those codes and store them in a safe place, as you may need to use them in case you lose access to your 2FA device. It is important to note that each of these codes is single use; it may only ever be used once and then expires. After using one, you can scratch it through with a pen or otherwise mark that the code has been used. To generate a new set of codes, you will need to disable and re-enable two-factor authentication.
Disabling two-factor authentication without an authentication device
This may require two scratch codes: one to log in, and another to disable. Should you ever need to use any of your scratch codes, it is advisable to disable and re-enable to generate a fresh set of codes as soon as possible.
Recovering from a lost or broken authentication device
If you have an existing 2FA device which has simply stopped generating the correct codes, check that its clock is reasonably accurate. Time-based OTP on our wikis has been known to fail with 2 minutes difference.
You will need access to the scratch codes that you were provided when enrolling in order to un-enroll from two-factor authentication. It will require you to use up to two scratch codes to accomplish this:
- You need to be logged in. If you are not already logged in, this will require use of a scratch code.
- Visit Special:OATH and use a different scratch code to disable two-factor authentication.
If you don't have enough scratch codes, you may contact Trust and Safety at cawikimedia.org to request removal of 2FA from your account (please send an email using your registered email address of your wiki account). You should also create a task on Phabricator if you still have access to it. Please note, 2FA removal by staff is not always granted.
Web Authentication Method
Please note, most of the directions on this page are specific to the TOTP method. The WebAuthn method is more experimental and currently has no recovery options (c.f. phab:T244348).
- English Wikipedia article and Wikidata item about the concept of multi-factor authentication
- Known bugs and requested improvements of Wikimedia's two-factor authentication are tracked in Phabricator.
- OATHAuth is the MediaWiki extension used for this functionality
- Wikimedia Security Team/Two-factor Authentication for CentralAuth wikis
- Help:Two-factor authentication in the MediaWiki.org