Row-level security
Postgres RLS scopes every secret. Each user can only ever read the codes in the groups they belong to - enforced at the database, not just the UI.
security
Built with defense in depth
Sharing 2FA is only worth it if it's genuinely secure. 2fashare makes the secure path the default path - scoped access, encrypted secrets, and a full audit trail at every step.
Encrypted at rest
TOTP secrets are encrypted at rest and never leave an authenticated session in raw form.
Short-lived share links
Every share link is time-boxed and revokable, so external access ends on schedule or the moment you cancel it.
One-click revoke
Remove a member or kill a link and access disappears instantly - no rotating shared secrets across systems.
Complete audit trail
Every view, copy, share, and rotation is logged and searchable, so you always know who accessed what.
Secure by default
Least-privilege roles and group-scoped access mean the safe path is the default path, not an extra step.
Why row-level security matters
Most tools enforce access in the application layer - hide a button, filter a list - but the data is still reachable underneath. 2fashare enforces access in the database itself with Postgres row-level security.
That means a member can only ever read the codes in the groups they belong to, full stop. There's no view that accidentally leaks a secret and no API path that returns more than it should. Access is a property of the data, not a UI convenience.
FAQ
Common questions
How are 2FA secrets stored?
Secrets are encrypted at rest and protected by Postgres row-level security. They're never exposed outside an authenticated session.
Can someone see codes they weren't granted?
No. Access is enforced at the database with row-level security, scoped per group and role - not just hidden in the interface.
What happens to access when someone leaves?
Remove the member and they immediately lose access to every code in every group, with no need to rotate the underlying secrets.
Is sharing outside the team safe?
Share links are time-boxed and revokable, and they grant access to live rotating codes rather than exposing the raw secret.
Secure, shared 2FA - without the spreadsheets.
Set up your team in minutes. Free to get started, no credit card.