Authorization : 2FA + Piwigo Mobile app Factor Authentication #1886

New Issue

Closed

opened 2026-10-05 00:59:46 +02:00 by adam · 35 comments

adam commented 2026-10-05 00:59:46 +02:00

Owner

Copy link

Copy source

Hi
I want to say that I am very happy with using Piwigo. The author of the app deserves great Applause.

Reason:
Nowadays, security is playing an increasingly important role. The computing power used to crack passwords has gained significant efficiency. For this reason, a strong password isn't as secure as it used to be. Sorry for adding another topic, but I think I started an important problem. I guess that many users would like their private photos, videos to be well protected. Piwigo has a mobile app that is great for this feature 👏

Suggestion for marking the topic:
Type: Feature
Type: Enhancement
Section: Users & Groups
Priority: High
Milestone: Yes

Main part:
Does the Product Owner plan to consider my request to create a 2FA (two-factor authentication) or MFA for the Piwigo app based on an event in a trusted device. A plugin for Piwigo doesn't seem like a good solution for anyone (I saw that one plugin exists in beta), but it is such a basic and integral feature that it shouldn't be implemented as an add-on.

Proposed scenario for Product Owner:

1. In the application, the Piwigo webapp Administrator can select an option (I treat the solution I propose as an option - the Administrator has the right not to decide on protection): "Login only with authorization in the Piwigo mobile app." for themselves or for a specific user/group.
2. The Administrator is shown the Token key in case of loss of the device where the mobile app was used for authorization.
3. Warning about data backup:

• Token Key
• Media (photos, videos, etc.) in case of server failure, loss of the token and the device with the mobile app.

4. The Administrator logs into the Piwigo mobile app and receives a message about adding the device to trusted. Even if someone steals the password, logging in to the new mobile app won't nothing. Trusted devices can be managed only via the Piwigo webapp (website sends requests to new devices - adding them to trusted). At this point, the captured password won't allow you to log in to the Piwigo application website, because it already verifies it through a trusted device with the Piwigo mobile app.
5. The User account created by the Administrator receives the following information upon login: "Request for secure login to . Install the mobile app and follow the steps given in the guide" - from now on, the user has 7 days to complete authorization. If they don't do it in this specified time, their account will be blocked. After blocking, they must write a message to the Administrator asking for unblocking.

Summary:
There are already 2 applications (webapp and mobile). All that remains is:

1. Creating a push token mechanism (encrypted) to the mobile application from the server .
2. Encryption with a salt of token keys in the DataBase

I'd appreciate a full answer. Please don't treat my message as a demand - it is a request.

Best regards
Luke

Hi I want to say that I am very happy with using Piwigo. The author of the app deserves great **Applause**. **Reason:** Nowadays, security is playing an increasingly important role. The computing power used to crack passwords has gained significant efficiency. For this reason, a strong password **isn't as secure as it used to be**. Sorry for adding another topic, but I think I started an important problem. I guess that many users would like their private photos, videos to be well protected. Piwigo has a mobile app that is great for this feature 👏 **Suggestion for marking the topic:** Type: Feature Type: Enhancement Section: Users & Groups Priority: High Milestone: Yes **Main part:** Does the Product Owner plan to consider my request to create a 2FA (two-factor authentication) or MFA for the Piwigo app based on an event in a **trusted device**. A plugin for Piwigo doesn't seem like a good solution for anyone (I saw that one plugin exists in beta), but it is such a basic and integral feature that it shouldn't be implemented as an add-on. **Proposed scenario for Product Owner:** 1. In the application, the Piwigo webapp Administrator can select an option (I treat the solution I propose as an option - the Administrator has the right not to decide on protection): "Login only with authorization in the Piwigo mobile app." for themselves or for a specific user/group. 2. The Administrator is shown the Token key in case of loss of the device where the mobile app was used for authorization. 3. Warning about data backup: - Token Key - Media (photos, videos, etc.) in case of server failure, loss of the token and the device with the mobile app. 4. The Administrator logs into the Piwigo mobile app and receives a message about adding the device to trusted. Even if someone steals the password, logging in to the new mobile app won't nothing. Trusted devices can be managed only via the Piwigo webapp (website sends requests to new devices - adding them to trusted). At this point, the captured password won't allow you to log in to the Piwigo application website, because it already verifies it through a trusted device with the Piwigo mobile app. 5. The User account created by the Administrator receives the following information upon login: "Request for secure login to <Piwigo instance name>. Install the mobile app and follow the steps given in the guide" - from now on, the user has 7 days to complete authorization. If they don't do it in this specified time, their account will be blocked. After blocking, they must write a message to the Administrator asking for unblocking. Summary: There are already 2 applications (webapp and mobile). All that remains is: 1. Creating a **push token mechanism (encrypted)** to the mobile application from the server <Piwigo instance name>. 2. Encryption with a salt of token keys in the DataBase I'd appreciate a full answer. Please don't treat my message as a demand - it is a request. Best regards Luke <!-- github-sync-id:2360266821 -->

adam closed this issue 2026-10-05 00:59:46 +02:00

adam commented 2026-10-05 00:59:47 +02:00

Author

Owner

Copy link

Copy source

I support this - I have a similar request on the Piwigo forums, but I agree TOTP should be a core feature:

https://piwigo.org/forum/viewtopic.php?id=33186

I support this - I have a similar request on the Piwigo forums, but I agree TOTP should be a core feature: https://piwigo.org/forum/viewtopic.php?id=33186 <!-- github-comment-id:2209672660 -->

adam commented 2026-10-05 00:59:47 +02:00

Author

Owner

Copy link

Copy source

I support this - I have a similar request on the Piwigo forums, but I agree TOTP should be a core feature:

https://piwigo.org/forum/viewtopic.php?id=33186

Thank You for Your interest 😍 Of course, Your topic also concerns security: OTP. I think that six-digit tokens should be mainly for administrator (expire every 30 seconds). Please keep in mind the different age of the users - for older people it is easier to click "accept" than to copy the numbers from another app.
My proposal seems easier and faster (and maybe even safer) to implement for everyone because the server and mobile app already exist. For the Administrator I'd consider your proposal (I use OTP in other services and I think it is a good way). Thank you for your understanding.

> I support this - I have a similar request on the Piwigo forums, but I agree TOTP should be a core feature: > > https://piwigo.org/forum/viewtopic.php?id=33186 Thank You for Your interest 😍 Of course, Your topic also concerns security: OTP. I think that six-digit tokens should be mainly for administrator (expire every 30 seconds). Please keep in mind the different age of the users - for older people it is easier to click "accept" than to copy the numbers from another app. My proposal seems easier and faster (and maybe even safer) to implement for everyone because the server and mobile app already exist. For the Administrator I'd consider your proposal (I use OTP in other services and I think it is a good way). Thank you for your understanding. <!-- github-comment-id:2209785397 -->

adam commented 2026-10-05 00:59:48 +02:00

Author

Owner

Copy link

Copy source

I concur with this. i wanted to request for the same.

At least MFA/2FA with Google Authenticator, Microsoft Authenticator or with the mobile app will be a super nice security improvement.

Thank you PIWIGO team!!

I concur with this. i wanted to request for the same. At least MFA/2FA with Google Authenticator, Microsoft Authenticator or with the mobile app will be a super nice security improvement. Thank you PIWIGO team!! <!-- github-comment-id:2523366950 -->

adam commented 2026-10-05 00:59:49 +02:00

Author

Owner

Copy link

Copy source

@alwanga Thanks for Your interest. The growing awareness of users can be pleasing. Recently, we can see systematic interest of users here. I regret that I can't be more active, but I don't have free time.

I hope that Piwigo Team will present us with official position on this matter. Securing authorization process by using available Authentication methods:
—≻ Approving the Access Token in the application;
—≻ 2FA/MFA (TOTP).
is the biggest challenge for Piwigo today.

Authentication methods aren't mutually exclusive. Please take a look at my considerations:
Piwogo already has a great and mature mobile app and possibility of the Administrator forcing user to create Authentication Token when joining the server doesn't mean working from scratch. The huge advantage of this solution is its simplicity. I think that not only my users are at advanced age, where using a phone isn't simple and obvious. A pop-up notification (or a requirement to open the app to see notification - matter of user habit) like as: "someone is trying to log in to Your account (Nick): (MM:HH DD:MM:YYYY) from the device (useragent). Allow access? [Y/N]" is definitely easier than opening another app and typing 6 digits in a short time. TOTP should also be possible for the Administrator to use based on the user's technical skills.
If user loses smartphone:

• Account's still protected by a password;
• It would be possible to create an automatic block (users) feature for 5 min, 20 min, 30 min, after a specified number of attempts (admin could unlock the account from the server manually).

MFA/2FA will be more suitable for authenticating administrator in the server app.

---

I DON'T WANT TO FORCE ANY ACTION ON PIWIGO - THIS IS A FREE DISCUSSION

IN WHICH I HOPE TO GET TO KNOW THE OPINION OF THE PIWIGO TEAM.

---

@alwanga Thanks for Your interest. The growing awareness of users can be pleasing. Recently, we can see systematic interest of users here. I regret that I can't be more active, but I don't have free time. I hope that Piwigo Team will present us with official position on this matter. Securing authorization process by using available Authentication methods: —≻ Approving the Access Token in the application; —≻ 2FA/MFA (TOTP). is the biggest challenge for Piwigo today. Authentication methods aren't mutually exclusive. Please take a look at my considerations: Piwogo already has a great and mature mobile app and possibility of the Administrator forcing user to create Authentication Token when joining the server doesn't mean working from scratch. The huge advantage of this solution is its simplicity. I think that not only my users are at advanced age, where using a phone isn't simple and obvious. A pop-up notification (or a requirement to open the app to see notification - matter of user habit) like as: "someone is trying to log in to Your account (Nick): (MM:HH DD:MM:YYYY) from the device (useragent). Allow access? [Y/N]" is definitely easier than opening another app and typing 6 digits in a short time. TOTP should also be possible for the Administrator to use based on the user's technical skills. If user loses smartphone: - Account's still protected by a password; - It would be possible to create an automatic block (users) feature for 5 min, 20 min, 30 min, after a specified number of attempts (admin could unlock the account from the server manually). MFA/2FA will be more suitable for authenticating administrator in the server app. _______________________________________________________________________________________________________________________________________ ### I DON'T WANT TO FORCE ANY ACTION ON PIWIGO - THIS IS A FREE DISCUSSION ### IN WHICH I HOPE TO GET TO KNOW THE OPINION OF THE PIWIGO TEAM. _______________________________________________________________________________________________________________________________________ <!-- github-comment-id:2524018541 -->

adam commented 2026-10-05 00:59:49 +02:00

Author

Owner

Copy link

Copy source

@ZicPL i concur with your perspective. All we would need is a way to not only rely alone on username/password.
@Eric-Piwigo @Piwigo-TranslationTeam , any thoughts about this issue, please?

@ZicPL i concur with your perspective. All we would need is a way to not only rely alone on username/password. @Eric-Piwigo @Piwigo-TranslationTeam , any thoughts about this issue, please? <!-- github-comment-id:2525191214 -->

adam commented 2026-10-05 00:59:50 +02:00

Author

Owner

Copy link

Copy source

I used Piwigo a long time ago. Now I use Ente because it encrypts data and provides more security, but wastes more resources.. I will gladly give Piwigo a second chance when it improves security because the password itself is pathetic today..

I used Piwigo a long time ago. Now I use Ente because it encrypts data and provides more security, but wastes more resources.. I will gladly give Piwigo a second chance when it improves security because the password itself is pathetic today.. <!-- github-comment-id:2526806409 -->

adam commented 2026-10-05 00:59:51 +02:00

Author

Owner

Copy link

Copy source

Hello everyone,
From what I understand of the conversation, here are the key points (please let me know if I’ve missed anything):

• Strengthening Piwigo’s security through two-factor/multi-factor authentication (2FA/MFA).
• Offer this enhanced security via the Piwigo mobile application.
• Adding a 2FA/MFA option based on well-known TOTP providers (Google Authenticator, Microsoft Authenticator, etc.).
• Allowing these parameters to be configured according to specific user needs.
• Integrating this system directly into Piwigo’s core.

I’d also like to add another point:
In using the Piwigo API for an external project, I’m forced to store user credentials (username/password) to maintain a persistent session. This approach is not practical or safe. Implementing a more robust and API-friendly authentication system such as secure tokens would greatly simplify connection management and eliminate the need to store sensitive passwords.

What do you think?

Hello everyone, From what I understand of the conversation, here are the key points (please let me know if I’ve missed anything): - Strengthening Piwigo’s security through two-factor/multi-factor authentication (2FA/MFA). - Offer this enhanced security via the Piwigo mobile application. - Adding a 2FA/MFA option based on well-known TOTP providers (Google Authenticator, Microsoft Authenticator, etc.). - Allowing these parameters to be configured according to specific user needs. - Integrating this system directly into Piwigo’s core. I’d also like to add another point: In using the Piwigo API for an external project, I’m forced to store user credentials (username/password) to maintain a persistent session. This approach is not practical or safe. Implementing a more robust and API-friendly authentication system such as secure tokens would greatly simplify connection management and eliminate the need to store sensitive passwords. What do you think? <!-- github-comment-id:2531745537 -->

adam commented 2026-10-05 00:59:51 +02:00

Author

Owner

Copy link

Copy source

* Strengthening Piwigo’s security through two-factor/multi-factor authentication (2FA/MFA).

* Offer this enhanced security via the Piwigo mobile application.

* Adding a 2FA/MFA option based on well-known TOTP providers (Google Authenticator, Microsoft Authenticator, etc.).

* Allowing these parameters to be configured according to specific user needs.

* Integrating this system directly into Piwigo’s core.

What do you think?

@LintyDev, thank You for Your activity in this thread ❤

All of the goals You mentioned are touched upon here. In addition, to 5 points mentioned, You can add another one: activation of login via automatic e-mail. Naturally I see popularity of TOTP over Google Authenticator e.g. in logging into an account via a browser or in a mobile app.

@LintyDev, please let me explain now why this topic is only about ONE of the security features You listed (the rest should be considered in other issues/discussions). Ofc, none of the listed features exclude other security features (they also complement each other very well), but topic of this thread is:

Authorization Token from Mobile App.

I'd like to write here - I'm very impressed with Piwigo mobile app, which has great potential for future. Please, I'd like everyone here to focus ONLY on this ONE security feature: "logging in after approval in Piwigo mobile app".

Why?

I'll start with my reasons:

1. [Main reason] Improved security.

2. The Piwigo mobile app already exists and adding a feature is less expensive than the other way around (creating mobile app specifically for feature).

3. The feature isn't difficult to understand - there is only one use case: Approval of user login in browser by accepting the request in Piwigo mobile app.

4. The Mobile App is easy to use for old people or those without IT skills. They will learn faster how to approve logins via Piwigo mobile app, than how to copy the numbers from Google Authenticator (I was criticized more than once for demanding the use of the TOTP app, because it was too complicated).

5. The feature is easy to expand, e.g. trusted devices.

There're more reasons, but I listed those that seem obvious and don't require a detailed description.
As You may have noticed, description of how feature works looks like this:

• Piwigo Admin (own instance) in user settings: edits the selected account.
• In account security section, select one of available options (an example graphic will make it easier to understand):
  

We select the option: "Website login requires approval in the Piwigo mobile application"

• From now on, after entering Login and Password in login panel (browser), user must open Piwigo mobile app to accept request (notification will appear in moible app).
• The user has logged in.

Other situations:
If Admin (some Piwigo instance) has selected this checkbox and user uninstalls the app, this user won't log in.
If user loses their phone (it's stolen), She/He won't log in.
If user has several Piwigo mobile apps (several devices) and is logged in to all of them, I suggest using AUTO logout so that user can only be logged in to ONE Piwigo Mobile App.

In all 3 cases, it's recommended to contact Admin of specific server instance.

@LintyDev I presented description of "approve login via mobile app" feature as precisely as I can, but I'm not a developer - that's why I didn't write here technical details of implementation. I'll be grateful for Your understanding ✋

> * Strengthening Piwigo’s security through two-factor/multi-factor authentication (2FA/MFA). > > * Offer this enhanced security via the Piwigo mobile application. > > * Adding a 2FA/MFA option based on well-known TOTP providers (Google Authenticator, Microsoft Authenticator, etc.). > > * Allowing these parameters to be configured according to specific user needs. > > * Integrating this system directly into Piwigo’s core. > What do you think? @LintyDev, thank You for Your activity in this thread ❤ All of the goals You mentioned are touched upon here. In addition, to 5 points mentioned, You can add another one: activation of login via automatic e-mail. Naturally I see popularity of TOTP over Google Authenticator e.g. in logging into an account via a browser or in a mobile app. @LintyDev, please let me explain now why this topic is only about **ONE** of the security features You listed (the rest should be considered in other issues/discussions). Ofc, none of the listed features exclude other security features (they also complement each other very well), but topic of this thread is: ### Authorization Token <ins>from Mobile App</ins>. I'd like to write here - I'm very impressed with Piwigo mobile app, which has great potential for future. Please, I'd like everyone here to focus **ONLY** on this ONE security feature: "logging in after approval in Piwigo mobile app". ### Why? I'll start with my reasons: 1. [Main reason] Improved security. 2. The Piwigo mobile app already exists and adding a feature is less expensive than the other way around (creating mobile app specifically for feature). 3. The feature isn't difficult to understand - there is only one use case: Approval of user login in browser by accepting the request in Piwigo mobile app. 4. The Mobile App is easy to use for old people or those without IT skills. They will learn faster how to approve logins via Piwigo mobile app, than how to copy the numbers from Google Authenticator (I was criticized more than once for demanding the use of the TOTP app, because it was too complicated). 5. The feature is easy to expand, e.g. trusted devices. There're more reasons, but I listed those that seem obvious and don't require a detailed description. As You may have noticed, description of how feature works looks like this: - Piwigo Admin (own instance) in user settings: edits the selected account. - In account security section, select one of available options (an example graphic will make it easier to understand):  We select the option: "Website login requires approval in the Piwigo mobile application" - From now on, after entering Login and Password in login panel (browser), user must open Piwigo mobile app to accept request (notification will appear in moible app). - The user has logged in. Other situations: If Admin (some Piwigo instance) has selected this checkbox and user uninstalls the app, this user won't log in. If user loses their phone (it's stolen), She/He won't log in. If user has several Piwigo mobile apps (several devices) and is logged in to all of them, I suggest using AUTO logout so that user can only be logged in to ONE Piwigo Mobile App. In all 3 cases, it's recommended to contact Admin of specific server instance. @LintyDev I presented description of "approve login via mobile app" feature as precisely as I can, but I'm not a developer - that's why I didn't write here technical details of implementation. I'll be grateful for Your understanding ✋ <!-- github-comment-id:2534637344 -->

adam commented 2026-10-05 00:59:52 +02:00

Author

Owner

Copy link

Copy source

I confirm, using mobile application to confirm login would be extremely convenient and practical 👍
I have one question:
@ZicPL what if user who is admin loses device with the mobile application?

I confirm, using mobile application to confirm login would be extremely convenient and practical 👍 I have one question: @ZicPL what if user who is admin loses device with the mobile application? <!-- github-comment-id:2537662483 -->

adam commented 2026-10-05 00:59:53 +02:00

Author

Owner

Copy link

Copy source

@Mich3lleV nice to welcome You to this thread.

Mich3lleV said: What if user who is admin loses device with the mobile application?

If user and admin are the same person who lost mobile app in (title feature was working), then You should answer question:
Did this person create their Piwigo instance (do this person has access to server / hosting / etc.)?

• If answer is yes, then this person should log in to server (via SSH/FTP) and edit the configuration file (disable parameter that activates feature from this discussion).
• If answer is no, then this person should immediately contact the owner of server / hosting / shared hosting account / etc. and ask to edit configuration file (specified parameter defines this feature).

More technical details could be answered by the Piwigo devs Team - who would implement this feature. At the moment it's an idea/concept of a feature.

🔽
🔽
🔽

---

Currently, I'd like to inform all that I thank everyone for their interest in this feature, but I've to limit my activity in this thread because I've a lot of work to do at my job. I'll be checking in, but my replies may be late. I think the discussion is at a point where feature has been clearly defined (user need) and it's time for Piwigo owner/developers to get involved and discuss technical details. Good Luck 👋

---

@Mich3lleV nice to welcome You to this thread. > [Mich3lleV](https://github.com/Mich3lleV) said: What if user who is admin loses device with the mobile application? If user and admin are the same person who lost mobile app in (title feature was working), then You should answer question: Did this person create their Piwigo instance (do this person has access to server / hosting / etc.)? - If answer is yes, then this person should log in to server (via SSH/FTP) and edit the configuration file (disable parameter that activates feature from this discussion). - If answer is no, then this person should immediately contact the owner of server / hosting / shared hosting account / etc. and ask to edit configuration file (specified parameter defines this feature). More technical details could be answered by the Piwigo devs Team - who would implement this feature. At the moment it's an idea/concept of a feature. 🔽 🔽 🔽 _________________________________________________________________________________________________________________________________________ Currently, I'd like to inform all that I thank everyone for their interest in this feature, but I've to limit my activity in this thread because I've a lot of work to do at my job. I'll be checking in, but my replies may be late. I think the discussion is at a point where feature has been clearly defined (user need) and it's time for Piwigo owner/developers to get involved and discuss technical details. Good Luck 👋 _________________________________________________________________________________________________________________________________________ <!-- github-comment-id:2537736048 -->

adam commented 2026-10-05 00:59:53 +02:00

Author

Owner

Copy link

Copy source

I need to say I would prefer TOTP over Mobile App. TOTP codes can be backed up and restored, and are not dependent on a specific device / app - you can choose to use Google Authenticator, Authy, Duo, MS Authenticator, etc. Also, this should be easier to implement than a dedicated connection to a specific app.

While I'm not against App-Specific MFA, I would prefer to see TOTP first, then other methods.

I need to say I would prefer TOTP over Mobile App. TOTP codes can be backed up and restored, and are not dependent on a specific device / app - you can choose to use Google Authenticator, Authy, Duo, MS Authenticator, etc. Also, this should be easier to implement than a dedicated connection to a specific app. While I'm not against App-Specific MFA, I would prefer to see TOTP first, then other methods. <!-- github-comment-id:2539320717 -->

adam commented 2026-10-05 00:59:54 +02:00

Author

Owner

Copy link

Copy source

Good Luck 👋

@ZicPL don't leave.. You were the only one leading this issue in the right direction. If someone from Piwigo reacts (soon ?), it would be good if you were with us 😜

> Good Luck 👋 @ZicPL don't leave.. You were the only one leading this issue in the right direction. If someone from Piwigo reacts (soon ?), it would be good if you were with us 😜 <!-- github-comment-id:2539668723 -->

adam commented 2026-10-05 00:59:55 +02:00

Author

Owner

Copy link

Copy source

Hello again @GJSchaller 👋
You're right that TOTP is important. I think it's better than no security, what we have now (50 character password is security, but Piwigo deserves more). Also, TOTP (2FA) Request should also have its OWN issue in Piwigo project. Accepting authentication in Piwigo Mobile App and TOTP can work TOGETHER (complement each other). Personally, I'd like both features to be implemented in Piwigo - it would be great. However, I can't understand why TOTP is appearing here again?
Isn't there a request for this 2FA (TOTP) feature in Piwigo project?

@RobyB89 I'm here ☺️, but I don't see how I can help here. I think we have to wait for the decision of Piwigo owner/developers because they have to analyze costs of implementing this feature or reject idea/concept (then I'll close this issue because it wont make sense). Thanks to their hard work, every year we get better and better Piwgo. Therefore, let us be grateful to them and wait patiently - without pressure. Their positive consideration of the request would be great.

Hello again @GJSchaller 👋 You're right that TOTP is important. I think it's better than no security, what we have now (50 character password is security, but Piwigo deserves more). Also, TOTP (2FA) Request should also have its **OWN** issue in Piwigo project. Accepting authentication in Piwigo Mobile App and TOTP can work **TOGETHER** (complement each other). Personally, I'd like both features to be implemented in Piwigo - it would be great. However, I can't understand why TOTP is appearing here again? <ins>Isn't there a request for this 2FA (TOTP) feature in Piwigo project?</ins> @RobyB89 I'm here ☺️, but I don't see how I can help here. I think we have to wait for the decision of Piwigo owner/developers because they have to analyze costs of implementing this feature or reject idea/concept (then I'll close this issue because it wont make sense). Thanks to their hard work, every year we get better and better Piwgo. Therefore, let us be grateful to them and wait patiently - without pressure. Their positive consideration of the request would be great. <!-- github-comment-id:2539713378 -->

adam commented 2026-10-05 00:59:56 +02:00

Author

Owner

Copy link

Copy source

Today, we discussed this topic with @plegall , and here’s what came out of it: At Piwigo, we have already had a similar topic, which was about passkeys, brought up by @EddyLB . A solution that could replace passwords and is more secure, but we are also aware that this system is still a bit too early for the world.

For the implementation in Piwigo: In the first stage, we could have a two-factor authentication (2FA) plugin included in the Piwigo build (similar to LocalFilesEditor or AdminTools), with a 2FA functionality via third-party apps (such as Authy, 1Password, Bitwarden, etc.), with the option to enforce or not enforce the use of 2FA for users.

Why as a plugin? Because releasing a new plugin is easier and faster than releasing a new version of Piwigo, giving us time to develop all the features.

Why only 2FA via third-party apps initially? Because, in the beginning, it’s simpler and more secure to integrate into Piwigo. These changes also require us to rethink how we use the API (I will create another issue related to this). Personally, I believe that adding functionalities (different types of 2FA) gradually is preferable as it allows us to focus on making each feature robust. This gradual approach also allows us to better address user needs and ensures that the security features are both effective and user-friendly.

In the second phase, we could add this functionality through the iOS/Android Piwigo apps. This is where we return to @ZicPL’s original request, and I want to emphasize your argument about older people or those without technical skills. It could be reassuring to have the entire authentication system within the "official" Piwigo environment. While third-party apps like Google Authenticator and Authy are great, the simplicity of receiving push notifications directly within the Piwigo app could make the process much easier to adopt for users who aren’t as familiar with technology.

In all cases, these functionalities will follow the TOTP convention (Time-based One-Time Password), which means the use of a unique secret key per user, generating a time-sensitive code (e.g., 123456) that is valid for a short time (usually 30 seconds). This is a widely accepted standard for 2FA and ensures both security and compatibility with many third-party apps ( @GJSchaller , for the use of TOTP method, I agree with you )

@ZicPL , I think the configuration in your screen should actually be in the gallery (in different way) so that the user can choose their preferred 2FA method?

Today, we discussed this topic with @plegall , and here’s what came out of it: At Piwigo, we have already had a similar topic, which was about passkeys, brought up by @EddyLB . A solution that could replace passwords and is more secure, but we are also aware that this system is still a bit too early for the world. For the implementation in Piwigo: In the first stage, we could have a two-factor authentication (2FA) plugin included in the Piwigo build (similar to LocalFilesEditor or AdminTools), with a 2FA functionality via third-party apps (such as Authy, 1Password, Bitwarden, etc.), with the option to enforce or not enforce the use of 2FA for users. **Why as a plugin?** Because releasing a new plugin is easier and faster than releasing a new version of Piwigo, giving us time to develop all the features. **Why only 2FA via third-party apps initially?** Because, in the beginning, it’s simpler and more secure to integrate into Piwigo. These changes also require us to rethink how we use the API (I will create another issue related to this). Personally, I believe that adding functionalities (different types of 2FA) gradually is preferable as it allows us to focus on making each feature robust. This gradual approach also allows us to better address user needs and ensures that the security features are both effective and user-friendly. In the second phase, we could add this functionality through the iOS/Android Piwigo apps. This is where we return to @ZicPL’s original request, and I want to emphasize your argument about older people or those without technical skills. It could be reassuring to have the entire authentication system within the "official" Piwigo environment. While third-party apps like Google Authenticator and Authy are great, the simplicity of receiving push notifications directly within the Piwigo app could make the process much easier to adopt for users who aren’t as familiar with technology. In all cases, these functionalities will follow the TOTP convention (Time-based One-Time Password), which means the use of a unique secret key per user, generating a time-sensitive code (e.g., 123456) that is valid for a short time (usually 30 seconds). This is a widely accepted standard for 2FA and ensures both security and compatibility with many third-party apps ( @GJSchaller , for the use of TOTP method, I agree with you ) @ZicPL , I think the configuration in your screen should actually be in the gallery (in different way) so that the user can choose their preferred 2FA method? <!-- github-comment-id:2541892109 -->

adam commented 2026-10-05 00:59:56 +02:00

Author

Owner

Copy link

Copy source

Thank you for your contribution, @LintyDev,

I am glad to hear that there is a plan for traction on this issue.

I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas.

In the meantime, we appreciate all the support we have received and will receive from the Piwigo team, esteemed contributors in this chat, and the community.

Thank you for your contribution, @LintyDev, I am glad to hear that there is a plan for traction on this issue. I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas. In the meantime, we appreciate all the support we have received and will receive from the Piwigo team, esteemed contributors in this chat, and the community. <!-- github-comment-id:2542068866 -->

adam commented 2026-10-05 00:59:57 +02:00

Author

Owner

Copy link

Copy source

Hi again @LintyDev,

Today, we discussed this topic with @plegall , and here’s what came out of it: At Piwigo, we have already had a similar topic, which was about passkeys, brought up by @EddyLB . A solution that could replace passwords and is more secure, but we are also aware that this system is still a bit too early for the world.

I wouldn't give up passwords completely. In the end, it could be more trouble than good.

For the implementation in Piwigo: In the first stage, we could have a two-factor authentication (2FA) plugin included in the Piwigo build (similar to LocalFilesEditor or AdminTools), with a 2FA functionality via third-party apps (such as Authy, 1Password, Bitwarden, etc.), with the option to enforce or not enforce the use of 2FA for users.

I totally agree. 2FA is very popular today and Piwigo deserves for this too. The plugin form isn't a bad idea, but it raises concerns about maintaining current version plugin for each new Piwigo. The option to force or not on user is a good move.

As I said yesterday, I'm glad that this 2FA information appears here, but is it necessary to write about it all time in this thread? Surely 2FA with acceptance of login in the Mobile app would create a great duo, powerfully securing access <3

What do You think I should change title of this thread -> "Authorization : 2FA + Token from Mobile App"? Maybe I'm being unnecessarily stubborn about limiting the discussion to one of authorization methods. I see that this thread is treated in general about these two security techniques. @LintyDev Let me know if You think this is a good idea, ok?

Why only 2FA via third-party apps initially? Because, in the beginning, it’s simpler and more secure to integrate into Piwigo. These changes also require us to rethink how we use the API (I will create another issue related to this). Personally, I believe that adding functionalities (different types of 2FA) gradually is preferable as it allows us to focus on making each feature robust. This gradual approach also allows us to better address user needs and ensures that the security features are both effective and user-friendly.

That's true. I use open-source alternative to Google Authenticator. It's really cool and I recommend it to everyone. Unfortunately, You won't convince me that it will be faster than accepting a notification from mobile app e.g. number of steps for login acceptance in Piwigo mobile app is much lower than TOTP.

In the second phase, we could add this functionality through the iOS/Android Piwigo apps. This is where we return to @ZicPL’s original request, and I want to emphasize your argument about older people or those without technical skills. It could be reassuring to have the entire authentication system within the "official" Piwigo environment. While third-party apps like Google Authenticator and Authy are great, the simplicity of receiving push notifications directly within the Piwigo app could make the process much easier to adopt for users who aren’t as familiar with technology.

I absolutely do not prioritize the implementation of this feature. This is a free, high-level discussion in which I like culture and rationalism. My reason I created this topic was just one thing. Piwigo mobile app already exists. It's a huge asset. If mobile app didn't exist, I wouldn't waste anyone's time (cost of both would be too high). Moreover, it's a very high level of security and combined with a trusted device, it will be as safe as mobile apps of Banks (world's top - yes yes I know that bank apps have audits, but this solution is so close.). Piwigo would certainly gain positive publicity among security experts. It's really worth taking this thread seriously.

In all cases, these functionalities will follow the TOTP convention (Time-based One-Time Password), which means the use of a unique secret key per user, generating a time-sensitive code (e.g., 123456) that is valid for a short time (usually 30 seconds). This is a widely accepted standard for 2FA and ensures both security and compatibility with many third-party apps ( @GJSchaller , for the use of TOTP method, I agree with you )

Both authentication methods complement each other.

@ZicPL , I think the configuration in your screen should actually be in the gallery (in different way) so that the user can choose their preferred 2FA method?

I know I didn't try my best. It was just a quick example. Would You mind uploading here a screenshot, where could be these two security features?

---

Hi @alwanga

I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas.

Good to see Your positive thinking. You wrote that you plan to gain IT skills and I think this request should be led by someone like that. Could you please take care of: "acceptance of login in the Piwigo application" - privately I have to catch up.

Hi again @LintyDev, > Today, we discussed this topic with @plegall , and here’s what came out of it: At Piwigo, we have already had a similar topic, which was about passkeys, brought up by @EddyLB . A solution that could replace passwords and is more secure, but we are also aware that this system is still a bit too early for the world. I wouldn't give up passwords completely. In the end, it could be more trouble than good. > For the implementation in Piwigo: In the first stage, we could have a two-factor authentication (2FA) plugin included in the Piwigo build (similar to LocalFilesEditor or AdminTools), with a 2FA functionality via third-party apps (such as Authy, 1Password, Bitwarden, etc.), with the option to enforce or not enforce the use of 2FA for users. I totally agree. 2FA is very popular today and Piwigo deserves for this too. The plugin form isn't a bad idea, but it raises concerns about maintaining current version plugin for each new Piwigo. The option to force or not on user is a good move. As I said yesterday, I'm glad that this 2FA information appears here, but is it necessary to write about it all time **in this thread**? Surely 2FA with acceptance of login in the Mobile app would create a great duo, powerfully securing access <3 What do You think I should change title of this thread -> "Authorization : 2FA + Token from Mobile App"? Maybe I'm being unnecessarily stubborn about limiting the discussion to one of authorization methods. I see that this thread is treated in general about these two security techniques. @LintyDev Let me know if You think this is a good idea, ok? > Why only 2FA via third-party apps initially? Because, in the beginning, it’s simpler and more secure to integrate into Piwigo. These changes also require us to rethink how we use the API (I will create another issue related to this). Personally, I believe that adding functionalities (different types of 2FA) gradually is preferable as it allows us to focus on making each feature robust. This gradual approach also allows us to better address user needs and ensures that the security features are both effective and user-friendly. That's true. I use open-source alternative to Google Authenticator. It's really cool and I recommend it to everyone. Unfortunately, You won't convince me that it will be faster than accepting a notification from mobile app e.g. number of steps for login acceptance in Piwigo mobile app is much lower than TOTP. > In the second phase, we could add this functionality through the iOS/Android Piwigo apps. This is where we return to @ZicPL’s original request, and I want to emphasize your argument about older people or those without technical skills. It could be reassuring to have the entire authentication system within the "official" Piwigo environment. While third-party apps like Google Authenticator and Authy are great, the simplicity of receiving push notifications directly within the Piwigo app could make the process much easier to adopt for users who aren’t as familiar with technology. I absolutely do not prioritize the implementation of this feature. This is a free, high-level discussion in which I like culture and rationalism. My reason I created this topic was just one thing. Piwigo mobile app already exists. It's a huge asset. If mobile app didn't exist, I wouldn't waste anyone's time (cost of both would be too high). Moreover, it's a very high level of security and combined with a trusted device, it will be as safe as mobile apps of Banks (world's top - yes yes I know that bank apps have audits, but this solution is so close.). Piwigo would certainly gain positive publicity among security experts. It's really worth taking this thread seriously. > In all cases, these functionalities will follow the TOTP convention (Time-based One-Time Password), which means the use of a unique secret key per user, generating a time-sensitive code (e.g., 123456) that is valid for a short time (usually 30 seconds). This is a widely accepted standard for 2FA and ensures both security and compatibility with many third-party apps ( @GJSchaller , for the use of TOTP method, I agree with you ) Both authentication methods complement each other. > @ZicPL , I think the configuration in your screen should actually be in the gallery (in different way) so that the user can choose their preferred 2FA method? I know I didn't try my best. It was just a quick example. Would You mind uploading here a screenshot, where could be these two security features? __________________________________________________________________________________________________________________________________________ Hi @alwanga >I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas. Good to see Your positive thinking. You wrote that you plan to gain IT skills and I think this request should be led by someone like that. Could you please take care of: "acceptance of login in the Piwigo application" - privately I have to catch up. <!-- github-comment-id:2542320031 -->

adam commented 2026-10-05 00:59:58 +02:00

Author

Owner

Copy link

Copy source

Hello @ZicPL :D
Hello @alwanga :D

I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas.

It's always a pleasure to see the community growing, you can also join the forum https://piwigo.org/forum/

What do You think I should change title of this thread -> "Authorization : 2FA + Token from Mobile App"? Maybe I'm being unnecessarily stubborn about limiting the discussion to one of authorization methods. I see that this thread is treated in general about these two security techniques. @LintyDev Let me know if You think this is a good idea, ok?

Yes, it's a good idea, because in the code, these methods will work together to a certain point! Above all, we're aiming for user comfort by offering several solutions for secure access to piwigo.

That's true. I use open-source alternative to Google Authenticator. It's really cool and I recommend it to everyone. Unfortunately, You won't convince me that it will be faster than accepting a notification from mobile app e.g. number of steps for login acceptance in Piwigo mobile app is much lower than TOTP.

To be honest, at the moment it's difficult to release new versions of the Piwigo NG (Android) mobile application. But we're also working on.

I absolutely do not prioritize the implementation of this feature. This is a free, high-level discussion in which I like culture and rationalism. My reason I created this topic was just one thing. Piwigo mobile app already exists. It's a huge asset. If mobile app didn't exist, I wouldn't waste anyone's time (cost of both would be too high). Moreover, it's a very high level of security and combined with a trusted device, it will be as safe as mobile apps of Banks (world's top - yes yes I know that bank apps have audits, but this solution is so close.). Piwigo would certainly gain positive publicity among security experts. It's really worth taking this thread seriously.

I understand, and we are taking this topic seriously. In my last response, I refocused the discussion on 2FA, particularly via third-party apps. This initial approach allows us to quickly integrate a robust and secure feature while adhering to current standards. However, we are considering both methods: 2FA via third-party apps and MFA via the Piwigo apps.

I know I didn't try my best. It was just a quick example. Would You mind uploading here a screenshot, where could be these two security features?

I haven’t told Alice, our designer, about the project yet, so please go easy on me 😁
I’ve started working on a plugin to integrate all these methods. I began with the 2FA method ( @ZicPL you’re probably going to get tired of me, haha sorry). Here’s how it could look (it’s already functional).

• Add a new parameter to profile.php
  

• The Activate button will open a modal window with the 2FA activation procedure.
  
  Don't be like me, never share your QR codes haha!
  At each connection, if the user has activated the 2FA, there will be a field to enter his totp code.

Hello @ZicPL :D Hello @alwanga :D > I am not a PHP developer, but I am thinking of joining the Piwigo dev community to contribute to the implementation of these ideas. It's always a pleasure to see the community growing, you can also join the forum https://piwigo.org/forum/ > What do You think I should change title of this thread -> "Authorization : 2FA + Token from Mobile App"? Maybe I'm being unnecessarily stubborn about limiting the discussion to one of authorization methods. I see that this thread is treated in general about these two security techniques. @LintyDev Let me know if You think this is a good idea, ok? Yes, it's a good idea, because in the code, these methods will work together to a certain point! Above all, we're aiming for user comfort by offering several solutions for secure access to piwigo. > That's true. I use open-source alternative to Google Authenticator. It's really cool and I recommend it to everyone. Unfortunately, You won't convince me that it will be faster than accepting a notification from mobile app e.g. number of steps for login acceptance in Piwigo mobile app is much lower than TOTP. To be honest, at the moment it's difficult to release new versions of the Piwigo NG (Android) mobile application. But we're also working on. > I absolutely do not prioritize the implementation of this feature. This is a free, high-level discussion in which I like culture and rationalism. My reason I created this topic was just one thing. Piwigo mobile app already exists. It's a huge asset. If mobile app didn't exist, I wouldn't waste anyone's time (cost of both would be too high). Moreover, it's a very high level of security and combined with a trusted device, it will be as safe as mobile apps of Banks (world's top - yes yes I know that bank apps have audits, but this solution is so close.). Piwigo would certainly gain positive publicity among security experts. It's really worth taking this thread seriously. I understand, and we are taking this topic seriously. In my last response, I refocused the discussion on 2FA, particularly via third-party apps. This initial approach allows us to quickly integrate a robust and secure feature while adhering to current standards. However, we are considering both methods: 2FA via third-party apps and MFA via the Piwigo apps. > I know I didn't try my best. It was just a quick example. Would You mind uploading here a screenshot, where could be these two security features? I haven’t told Alice, our designer, about the project yet, so please go easy on me 😁 I’ve started working on a plugin to integrate all these methods. I began with the 2FA method ( @ZicPL you’re probably going to get tired of me, haha sorry). Here’s how it could look (it’s already functional). - Add a new parameter to profile.php  - The `Activate` button will open a modal window with the 2FA activation procedure.  _Don't be like me, never share your QR codes haha!_ At each connection, if the user has activated the 2FA, there will be a field to enter his totp code. <!-- github-comment-id:2548361631 -->

adam commented 2026-10-05 00:59:58 +02:00

Author

Owner

Copy link

Copy source

To be honest, at the moment it's difficult to release new versions of the Piwigo NG (Android) mobile application. But we're also working on.

Oh, don't say that. 2/3 of my users use mobile app (problem of modern people). There is also a part that logs directly into browser on TV. It would be great if an app for Android TV was created to complete Web app and native apps for Android/iOS.

I understand, and we are taking this topic seriously. In my last response, I refocused the discussion on 2FA, particularly via third-party apps. This initial approach allows us to quickly integrate a robust and secure feature while adhering to current standards. However, we are considering both methods: 2FA via third-party apps and MFA via the Piwigo apps.

I have already corrected issue for both authentication methods. Starting work on implementing 2FA is completely understandable by me. Everyone of us hopes that 2FA plugin will always be maintained like Piwigo. I never said what should be first 😉

I haven’t told Alice, our designer, about the project yet, so please go easy on me 😁 I’ve started working on a plugin to integrate all these methods. I began with the 2FA method ( @ZicPL you’re probably going to get tired of me, haha sorry). Here’s how it could look (it’s already functional). (..)

It looks great !
I'll surprise You :) 2FA is also important to me, because I'll benefit most from it 😊 Ofc I'll try to teach my users to use TOTP, but I'm afraid that they will stay with passwords only (they still use SMS instead of messengers)..

At each connection, if the user has activated the 2FA, there will be a field to enter his totp code.

Will it be possible to deactivate 2FA (TOTP)?
e.g. when:

• from Your GUI (e.g. remove Token) or "Deactivate" next to "Activate";
• with disable plugin;
• from configuration file located in the Piwigo web app (in case of losing TOTP).

Will the administrator be able to force their users to use TOTP?

> To be honest, at the moment it's difficult to release new versions of the Piwigo NG (Android) mobile application. But we're also working on. Oh, don't say that. 2/3 of my users use mobile app (problem of modern people). There is also a part that logs directly into browser on TV. It would be great if an app for Android TV was created to complete Web app and native apps for Android/iOS. > I understand, and we are taking this topic seriously. In my last response, I refocused the discussion on 2FA, particularly via third-party apps. This initial approach allows us to quickly integrate a robust and secure feature while adhering to current standards. However, we are considering both methods: 2FA via third-party apps and MFA via the Piwigo apps. I have already corrected issue for both authentication methods. Starting work on implementing 2FA is completely understandable by me. Everyone of us hopes that 2FA plugin will always be maintained like Piwigo. I never said what should be first 😉 > I haven’t told Alice, our designer, about the project yet, so please go easy on me 😁 I’ve started working on a plugin to integrate all these methods. I began with the 2FA method ( @ZicPL you’re probably going to get tired of me, haha sorry). Here’s how it could look (it’s already functional). (..) It looks great ! I'll surprise You :) 2FA is also important to me, because I'll benefit most from it 😊 Ofc I'll try to teach my users to use TOTP, but I'm afraid that they will stay with passwords only (they still use SMS instead of messengers).. > At each connection, if the user has activated the 2FA, there will be a field to enter his totp code. Will it be possible to deactivate 2FA (TOTP)? e.g. when: - from Your GUI (e.g. remove Token) or "Deactivate" next to "Activate"; - with disable plugin; - from configuration file located in the Piwigo web app (in case of losing TOTP). Will the administrator be able to force their users to use TOTP? <!-- github-comment-id:2548706870 -->

adam commented 2026-10-05 00:59:59 +02:00

Author

Owner

Copy link

Copy source

is there anything new on the topic?
My young daughter got a phone from me and she likes to take pictures. I really liked the idea of ​​confirming the login because we know what kind of children are at that age. As a father, I would prefer to know what kind of phones the acceptance comes from. If I understand correctly, Google Authenticator will not give me that much information.

is there anything new on the topic? My young daughter got a phone from me and she likes to take pictures. I really liked the idea of ​​confirming the login because we know what kind of children are at that age. As a father, I would prefer to know what kind of phones the acceptance comes from. If I understand correctly, Google Authenticator will not give me that much information. <!-- github-comment-id:2678800310 -->

adam commented 2026-10-05 01:00:00 +02:00

Author

Owner

Copy link

Copy source

Would this location be more appropriate for this request?
https://github.com/Piwigo/Piwigo-Android/issues/278

Would this location be more appropriate for this request? https://github.com/Piwigo/Piwigo-Android/issues/278 <!-- github-comment-id:2678831528 -->

adam commented 2026-10-05 01:00:00 +02:00

Author

Owner

Copy link

Copy source

Hello @x-g3niu5

The topic is still ongoing. Within the team, we're discussing releasing it alongside the next major update (Piwigo 16.0.0) because we want to integrate this plugin into Piwigo's build. This also ties into a discussion about adding an API key, as the implementation of two-factor authentication could cause some issues with the current API.

Hello @x-g3niu5 The topic is still ongoing. Within the team, we're discussing releasing it alongside the next major update (Piwigo 16.0.0) because we want to integrate this plugin into Piwigo's build. This also ties into a discussion about adding an API key, as the implementation of two-factor authentication could cause some issues with the current API. <!-- github-comment-id:2678831917 -->

adam commented 2026-10-05 01:00:01 +02:00

Author

Owner

Copy link

Copy source

The topic is still ongoing. Within the team, we're discussing releasing it alongside the next major update (Piwigo 16.0.0) because we want to integrate this plugin into Piwigo's build. This also ties into a discussion about adding an API key, as the implementation of two-factor authentication could cause some issues with the current API.

Hi @LintyDev
I'm a copywriter and I'm interested in hosting (my 1st instance). I'd like to help, but PHP coding is beyond my skills at the moment. I'm very happy to hear from you. I hope you'll be able to solve your problems and achieve your goals. I'm with you!

> The topic is still ongoing. Within the team, we're discussing releasing it alongside the next major update (Piwigo 16.0.0) because we want to integrate this plugin into Piwigo's build. This also ties into a discussion about adding an API key, as the implementation of two-factor authentication could cause some issues with the current API. Hi @LintyDev I'm a copywriter and I'm interested in hosting (my 1st instance). I'd like to help, but PHP coding is beyond my skills at the moment. I'm very happy to hear from you. I hope you'll be able to solve your problems and achieve your goals. I'm with you! <!-- github-comment-id:2678857120 -->

adam commented 2026-10-05 01:00:02 +02:00

Author

Owner

Copy link

Copy source

Hey everyone,

Just wanted to let you know the Two Factor plugin is finally ready!
You can find it here: https://github.com/Piwigo/piwigo-two_factor

It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch.

Don't hesitate to read the README,  it covers everything you need to know and even includes some screenshots of the plugin in action!

If you have any feedback or run into any issues, please open them directly in the new repo so I can close this issue.

Hope you like it and that it fits your needs!

Hey everyone, Just wanted to let you know the Two Factor plugin is finally ready! You can find it here: https://github.com/Piwigo/piwigo-two_factor It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch. Don't hesitate to read the README,  it covers everything you need to know and even includes some screenshots of the plugin in action! If you have any feedback or run into any issues, please open them directly in the new repo so I can close this issue. Hope you like it and that it fits your needs! <!-- github-comment-id:3043737009 -->

adam commented 2026-10-05 01:00:02 +02:00

Author

Owner

Copy link

Copy source

Hey everyone,

Just wanted to let you know the Two Factor plugin is finally ready! You can find it here: https://github.com/Piwigo/piwigo-two_factor

It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch.

Don't hesitate to read the README,  it covers everything you need to know and even includes some screenshots of the plugin in action!

If you have any feedback or run into any issues, please open them directly in the new repo so I can close this issue.

Hope you like it and that it fits your needs!

Hi,
Great job! I've read the description + screenshots of plugin You released and it looks great. The plugin is built in such a way that it allows for extensions with new features. Administrators and parents can feel a bit safer that data is better secured.

Do You think that this plugin will be able to use the piwigo app for authentication in the future?
E-mail is great, but when an older person opens the app (when is connected to the internet), it would be nice if a push message with the authentication code appeared.

Kind Regards

> Hey everyone, > > Just wanted to let you know the Two Factor plugin is finally ready! You can find it here: https://github.com/Piwigo/piwigo-two_factor > > It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch. > > Don't hesitate to read the README,  it covers everything you need to know and even includes some screenshots of the plugin in action! > > If you have any feedback or run into any issues, please open them directly in the new repo so I can close this issue. > > Hope you like it and that it fits your needs! Hi, **Great job!** I've read the description + screenshots of plugin You released and it looks great. The plugin is built in such a way that it allows for extensions with new features. Administrators and parents can feel a bit safer that data is better secured. **Do You think that this plugin will be able to use the piwigo app for authentication in the future?** E-mail is great, but when an older person opens the app (when is connected to the internet), it would be nice if a push message with the authentication code appeared. Kind Regards <!-- github-comment-id:3044669527 -->

adam commented 2026-10-05 01:00:03 +02:00

Author

Owner

Copy link

Copy source

@ZicPL Yes, that will come a bit later (that’s the advantage of having it as a plugin, we can release updates without waiting for a new core version). For now, I focused on what was possible right away. And the good news is that we’ve resumed active development on the Android app, so our team will be able to sit down and discuss how to implement these features on both iOS and Android!

We don’t recommend using email for authentication. Instead, we suggest using an authenticator app, it works the same way as what you described for the Piwigo app, except you don’t receive a notification; you simply see a code appear in the app.

@ZicPL Yes, that will come a bit later (that’s the advantage of having it as a plugin, we can release updates without waiting for a new core version). For now, I focused on what was possible right away. And the good news is that we’ve resumed active development on the Android app, so our team will be able to sit down and discuss how to implement these features on both iOS and Android! We don’t recommend using email for authentication. Instead, we suggest using an authenticator app, it works the same way as what you described for the Piwigo app, except you don’t receive a notification; you simply see a code appear in the app. <!-- github-comment-id:3045489823 -->

adam commented 2026-10-05 01:00:04 +02:00

Author

Owner

Copy link

Copy source

@ZicPL Yes, that will come a bit later (that’s the advantage of having it as a plugin, we can release updates without waiting for a new core version). For now, I focused on what was possible right away. And the good news is that we’ve resumed active development on the Android app, so our team will be able to sit down and discuss how to implement these features on both iOS and Android!

❤️

> [@ZicPL](https://github.com/ZicPL) Yes, that will come a bit later (that’s the advantage of having it as a plugin, we can release updates without waiting for a new core version). For now, I focused on what was possible right away. And the good news is that we’ve resumed active development on the Android app, so our team will be able to sit down and discuss how to implement these features on both iOS and Android! ❤️ <!-- github-comment-id:3048901461 -->

adam commented 2026-10-05 01:00:05 +02:00

Author

Owner

Copy link

Copy source

It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch.

It looks like the latest version in the Master branch is 15.5.0 still - do we need to wait for 16.0 to be released?

> It's only compatible with Piwigo 16, so if you want to give it a try, make sure to install the latest version from the master branch. It looks like the latest version in the Master branch is 15.5.0 still - do we need to wait for 16.0 to be released? <!-- github-comment-id:3049176614 -->

adam commented 2026-10-05 01:00:05 +02:00

Author

Owner

Copy link

Copy source

@LintyDev Authentication in Piwigo mobile app would be great :)

As an admin, I could control the number of devices (apps) that allow login (I could block suspicious devices or manually allow access). When I use external authentication apps like Google Authenticator, I've no way to check how many devices the token is on.

@LintyDev Authentication in Piwigo mobile app would be great :) As an admin, I could control the number of devices (apps) that allow login (I could block suspicious devices or manually allow access). When I use external authentication apps like Google Authenticator, I've no way to check how many devices the token is on. <!-- github-comment-id:3050855336 -->

adam commented 2026-10-05 01:00:06 +02:00

Author

Owner

Copy link

Copy source

@GJSchaller Hi, currently on the master branch of the repo the version is 16.0.0beta1. It is the 15.x branch that you will have the latest versions of 15

@TesterEU Hi, as I said in the thread, of course it will happen soon. And for admin control I've set the base. You can reset the 2FA on each user for example (they will have to initialise it again). But it's true that there will be more control by adding authentication via the piwigo mobile app.

@GJSchaller Hi, currently on the master branch of the repo the version is `16.0.0beta1`. It is the 15.x branch that you will have the latest versions of 15 @TesterEU Hi, as I said in the thread, of course it will happen soon. And for admin control I've set the base. You can reset the 2FA on each user for example (they will have to initialise it again). But it's true that there will be more control by adding authentication via the piwigo mobile app. <!-- github-comment-id:3053326076 -->

adam commented 2026-10-05 01:00:07 +02:00

Author

Owner

Copy link

Copy source

(...) But it's true that there will be more control by adding authentication via the piwigo mobile app.

I agree with what you wrote. Nothing beats push authentication for your Piwigo mobile app.

➕ IP of guest attempting to access the App has everything administrator needs.
btw. It would be great if this plugin had a history/log of access attempts (successful and rejected).

Could you share your thoughts on: Is authentication via Piwigo mobile app push possible this year?

> (...) But it's true that there will be more control by adding authentication via the piwigo mobile app. I agree with what you wrote. Nothing beats push authentication for your Piwigo mobile app. ➕ IP of guest attempting to access the App has everything administrator needs. btw. It would be great if this plugin had a history/log of access attempts (successful and rejected). Could you share your thoughts on: Is authentication via Piwigo mobile app push possible this year? <!-- github-comment-id:3062377614 -->

adam commented 2026-10-05 01:00:07 +02:00

Author

Owner

Copy link

Copy source

(...) https://github.com/Piwigo/piwigo-two_factor

Install from Admin Panel (Recommended):

Log in to your Piwigo administration dashboard.
Go to Administration → Plugins → Add a new plugin.
Search for "Two Factor" in the plugin repository.
Click "Add" and then "Activate it now".

Manual Installation (Alternative):

Go to the Piwigo Extensions page.
Unzip the downloaded file.
Upload the extracted folder to your Piwigo gallery's plugins directory. The path should look like your-gallery/plugins/two_factor.
Go to Administration → Plugins and activate the plugin.

Hi, I wanted to test the plugin today, but it's not available on Piwigo (it's missing from the repository or the Pwigo extensions page).. Could you help me find it (re-upload it)?

> (...) https://github.com/Piwigo/piwigo-two_factor > > Install from Admin Panel (Recommended): > > Log in to your Piwigo administration dashboard. > Go to Administration → Plugins → Add a new plugin. > Search for "Two Factor" in the plugin repository. > Click "Add" and then "Activate it now". > > Manual Installation (Alternative): > > Go to the [Piwigo Extensions](https://piwigo.org/ext/) page. > Unzip the downloaded file. > Upload the extracted folder to your Piwigo gallery's plugins directory. The path should look like your-gallery/plugins/two_factor. > Go to Administration → Plugins and activate the plugin. Hi, I wanted to test the plugin today, but it's not available on Piwigo (it's missing from the repository or the Pwigo extensions page).. Could you help me find it (re-upload it)? <!-- github-comment-id:3145339883 -->

adam commented 2026-10-05 01:00:08 +02:00

Author

Owner

Copy link

Copy source

Hi, I wanted to test the plugin today, but it's not available on Piwigo (it's missing from the repository or the Pwigo extensions page).. Could you help me find it (re-upload it)?

Hi @ZicPL ,

The plugin is not yet available in the piwigo extensions page. To test the plugin, you need to install it manually on a 16.0.0beta version (via docker https://github.com/Piwigo/piwigo-docker/pkgs/container/piwigo or a bare metal install).

> Hi, I wanted to test the plugin today, but it's not available on Piwigo (it's missing from the repository or the Pwigo extensions page).. Could you help me find it (re-upload it)? Hi @ZicPL , The plugin is not yet available in the piwigo extensions page. To test the plugin, you need to install it manually on a 16.0.0beta version (via docker https://github.com/Piwigo/piwigo-docker/pkgs/container/piwigo or a bare metal install). <!-- github-comment-id:3145817626 -->

adam commented 2026-10-05 01:00:09 +02:00

Author

Owner

Copy link

Copy source

The plugin is not yet available in the piwigo extensions page. To test the plugin, you need to install it manually on a 16.0.0beta version..

Thanks for the quick reply. I'm currently using Piwigo on shared hosting. Let me know when Your plugin is available from the repository :)

> The plugin is not yet available in the piwigo extensions page. To test the plugin, you need to install it manually on a 16.0.0beta version.. Thanks for the quick reply. I'm currently using Piwigo on shared hosting. Let me know when Your plugin is available from the repository :) <!-- github-comment-id:3146067528 -->

adam commented 2026-10-05 01:00:09 +02:00

Author

Owner

Copy link

Copy source

(...) authentication via Piwigo mobile app push possible this year

+1
waiting for this <3

> (...) authentication via Piwigo mobile app push possible this year +1 waiting for this <3 <!-- github-comment-id:3208856345 -->

adam commented 2026-10-05 01:00:10 +02:00

Author

Owner

Copy link

Copy source

Hello everyone!

Good news, the plugin is now available directly in your Piwigo following the release of version 16.0.0.

• Plugin page: https://piwigo.org/ext/index.php?eid=1052
• GitHub repo: https://github.com/Piwigo/piwigo-two_factor

Hello everyone! Good news, the plugin is now available directly in your Piwigo following the release of version 16.0.0. - Plugin page: https://piwigo.org/ext/index.php?eid=1052 - GitHub repo: https://github.com/Piwigo/piwigo-two_factor <!-- github-comment-id:3575306449 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#1886