Multi-Factor Authentication
A stolen password should not be enough on its own. Rackvio adds a TOTP second factor to password logins, with single-use recovery codes and an optional organization-wide requirement — free on every plan, including the free self-hosted edition.
Key Benefits
What makes Rackvio's multi-factor authentication different.
Multi-factor authentication is included on every plan, Community Edition included. Charging for a second factor prices some customers out of being secure. SSO is a paid convenience because it moves authentication to your identity provider; stopping a stolen password from being enough on its own is not something anyone should have to buy.
Standard TOTP (RFC 6238) works with Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Aegis and anything else that implements it. Codes are computed from a shared secret and the clock, so enrolment and sign-in both work on a fully air-gapped install with no outbound connection at all.
Enrolling produces ten single-use recovery codes, shown exactly once and stored only as bcrypt hashes. They are the way back in when a phone is lost, and they keep working even if the deployment's encryption key has been rotated — because they do not depend on it.
An administrator can reset another user's enrolment when both the phone and the codes are gone. The action is administrator-only, scoped to their own organization, and written to the audit log with actor, target and timestamp. Administrators are not offered the button on their own row — changing your own factor requires proving you still hold one.
Turn on the organization-wide requirement and pick a grace window of one to ninety days. Users who have not enrolled are prompted at sign-in rather than refused at the door, and the switch itself refuses to arm until the administrator flipping it has enrolled — because they are the one person an admin reset cannot rescue.
How It Works
Get started in three straightforward steps.
Scan, or type the key
Rackvio shows a QR code and the same secret in plain text beside it. The manual key is not an afterthought: it is what makes enrolment possible from a desktop-only console, from an air-gapped workstation with no camera, and from a password manager's setup-key field.
Confirm with a code
Enrolment is not active until a code from the app is accepted, so a half-finished setup never leaves an account in a state where it thinks it is protected and is not. Confirming produces the ten recovery codes.
Sign in with password plus code
The login asks for the six-digit code as a second step, and offers a recovery code instead for anyone without their phone. Codes are accepted within thirty seconds either side of your device clock, and a code that has already been used is never accepted again.
Require it when you are ready
Administrators can make it mandatory for the whole organization from the security settings, with a grace period and a count of who has not enrolled yet. Turning it back off takes effect immediately and leaves everyone's existing authenticators in place.
Two Steps, Every Edition
3F7K-9QRT
M2XD-7BVH
Q84N-RJ5T
+ 7 more, shown once
Included on every plan — Community too
See Multi-Factor Authentication in action
Schedule a personalized demo and see how Rackvio can transform your infrastructure management.