MFA option is available for users

Passwords are compromised constantly — through phishing, credential stuffing from other breaches, or malware. Without MFA, a leaked password is a full account takeover. CWE-308 (Use of Single-Factor Authentication) directly identifies this gap. NIST 800-63B §4.2 defines Authenticator Assurance Level 2 as requiring a second factor; PCI-DSS Req-8.4.2 mandates MFA for all access to the cardholder data environment. OWASP A07 lists missing MFA as an authentication failure. MFA is the single control with the highest documented reduction in account takeover incidents — Google reported over 99% reduction in automated attacks when TOTP was enforced.

TOTP is the highest-value, lowest-infrastructure MFA option — no SMS costs, no phone number dependency:

import * as OTPAuth from 'otpauth'

// Generate TOTP secret during MFA enrollment
const totp = new OTPAuth.TOTP({
  issuer: 'YourApp',
  label: user.email,
  algorithm: 'SHA1',
  digits: 6,
  period: 30,
  secret: OTPAuth.Secret.generate()
})
// Store totp.secret.base32 encrypted on the user record
// Send totp.toString() as a QR code URI to the enrollment UI

If using Clerk or Auth0, enable MFA in the dashboard — no code changes required. Supabase Auth supports TOTP MFA natively via the supabase-js client. Enforce MFA for admin roles immediately; offer it as optional for regular users with a strong nudge during onboarding.