> ## Documentation Index
> Fetch the complete documentation index at: https://docs.privy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Multi-factor authentication (MFA) for embedded wallets requiring additional identity verification for signing

**Privy enables users to set up multi-factor authentication (MFA) for embedded wallets on both EVM networks and Solana.** MFA secures the embedded wallet by requiring additional identity verification for wallet actions, subject to the [MFA verification duration](https://dashboard.privy.io/admin/mfa-cache-duration).

<img src="https://mintcdn.com/privy-c2af3412/YvGXGsI-T4KAqoan/images/MFA.png?fit=max&auto=format&n=YvGXGsI-T4KAqoan&q=85&s=2ad6a50823b29bacbabd08067f025e0b" alt="images/MFA.png" width="1843" height="1317" data-path="images/MFA.png" />

Once a user enrolls in wallet MFA, **the user must complete MFA verification for actions that use the embedded wallet's private key**, subject to the [MFA verification duration](https://dashboard.privy.io/admin/mfa-cache-duration). This includes signing messages, sending transactions, exporting the wallet, and recovering the wallet on new devices.

<Info>
  If a user has multiple embedded wallets (e.g. on different blockchains, or multiple HD addresses),
  MFA enrollment applies to signatures and transactions from **all** of them.
</Info>

**Privy currently supports three methods of wallet MFA:**

* **Passkeys** (recommended): users verify with a previously registered passkey through biometric authentication on their device. Phishing-resistant, device-bound, and independent of third-party carriers or apps.
* **Time-based one-time password (TOTP)**, where users verify with a 6-digit MFA code from an authentication app, like Authy or Google Authenticator
* **SMS**, where users verify with a 6-digit MFA code sent to their phone number

<Warning>
  SMS-based MFA is vulnerable to SIM-swapping and interception attacks. For higher-security
  applications, use passkeys or TOTP instead.
</Warning>

<Warning>
  Enabling MFA on one active session affects all other active sessions. If a user has multiple
  sessions (e.g. mobile and web), MFA challenges appear on every session.
</Warning>

## Policy-based multi-factor authentication

By default, MFA enrollment requires verification for **all** wallet actions. Your app can implement **policy-based MFA** to require MFA only for specific actions while allowing routine transactions to proceed without additional verification.

For example, your app can:

* Require MFA only for transactions above a certain amount (e.g., transfers over 1000 USDC)
* Require MFA for withdrawals while allowing deposits without MFA
* Apply MFA requirements based on specific tokens, contracts, or actions

Your app achieves this by combining MFA with [wallet policies](/controls/policies/create-a-policy) and authorization keys for fine-grained control over when MFA triggers.

<Info>
  Learn how to implement policy-based MFA in the [policy-based MFA
  recipe](/recipes/policy-based-mfa).
</Info>