Built with defense in depth
Sharing 2FA is only worth it if it's genuinely secure. 2fashare makes the secure path the default path - scoped access, encrypted secrets, and a full audit trail at every step.
Row-level security
Postgres RLS scopes every secret. Each user can only ever read the codes in the groups they belong to - enforced at the database, not just the UI.
Encrypted at rest
TOTP secrets are encrypted at rest and never leave an authenticated session in raw form.
Short-lived share links
Every share link is time-boxed and revokable, so external access ends on schedule or the moment you cancel it.
One-click revoke
Remove a member or kill a link and access disappears instantly - no rotating shared secrets across systems.
Complete audit trail
Every view, copy, share, and rotation is logged and searchable, so you always know who accessed what.
Secure by default
Least-privilege roles and group-scoped access mean the safe path is the default path, not an extra step.
Why row-level security matters
Most tools enforce access in the application layer - hide a button, filter a list - but the data is still reachable underneath. 2fashare enforces access in the database itself with Postgres row-level security.
That means a member can only ever read the codes in the groups they belong to, full stop. There's no view that accidentally leaks a secret and no API path that returns more than it should. Access is a property of the data, not a UI convenience.
Common questions
How are 2FA secrets stored?+
Secrets are encrypted at rest and protected by Postgres row-level security. They're never exposed outside an authenticated session.
Can someone see codes they weren't granted?+
No. Access is enforced at the database with row-level security, scoped per group and role - not just hidden in the interface.
What happens to access when someone leaves?+
Remove the member and they immediately lose access to every code in every group, with no need to rotate the underlying secrets.
Is sharing outside the team safe?+
Share links are time-boxed and revokable, and they grant access to live rotating codes rather than exposing the raw secret.
Secure, shared 2FA - without the spreadsheets.
Set up your team in minutes. Free to get started, no credit card.