> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Don't Forget to Regenerate 2FA Secret Keys! - URL: https://securinglaravel.com/security-tip-dont-forget-to-regenerate-2fa-secret-keys/ - Published: 2024-06-30T22:00:00.000Z - Updated: 2025-09-10T11:31:31.000Z - Description: [Tip #84] It's not just passwords you need to worry about when it comes to authentication and stolen credentials: your 2FA secret keys may also be at risk! - Author: Stephen Rees-Carter - Tags: Security Tips, Authentication, TOTP, MFA A common mistake when implementing Time-based One-Time Password (TOTP) Two-Factor Authentication (2FA) is to generate the user's *secret key* **once**, and then reuse the same *secret key* even when TOTP is disabled and enabled, providing the user with **no mechanism to reset their key**. This opens up a similar risk to password reuse: if an attacker can obtain the user's *secret key*, and the user has no way to reset it, then the attacker just needs the user's password to successfully log in! (*As they will always have a valid TOTP!*) 😱 **But, why is this an issue, and how can an attacker obtain the user's secret key?** While it is unlikely, it's not unheard of for 2FA secret keys to be leaked in some way - such as with the [Spoutible data breach](https://www.troyhunt.com/how-spoutibles-leaky-api-spurted-out-a-deluge-of-personal-data/?ref=securinglaravel.com), but also consider if the user's device is compromised: an attacker could access the user's authenticator app and steal their *secret keys* \- the user would need to reset their passwords and TOTP keys ASAP! **The solution is simple: wipe the *secret key* when TOTP is disabled, and generate a fresh key when TOTP is enabled.** ## Stay One Step Ahead of Security Threats! Join **Securing Laravel* and arm yourself with the knowledge to protect your applications. Get [weekly security tips](https://securinglaravel.com/tag/tips/) delivered straight to your inbox, plus upgrade for access to [monthly In Depth articles](https://securinglaravel.com/tag/in-depth/) that dive deep into crucial security topics. By signing up, you're not just securing your code – you're supporting ongoing security research in the Laravel and PHP community! Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. This will ensure a fresh key any time TOTP is toggled, and provide a logical reset method if the user needs to reset their key. [Laravel Fortify](https://laravel.com/docs/11.x/fortify?ref=securinglaravel.com) (the backend for [Jetstream](https://jetstream.laravel.com/?ref=securinglaravel.com)) does this with it's [EnableTwoFactorAuthentication](https://github.com/laravel/fortify/blob/1.x/src/Actions/EnableTwoFactorAuthentication.php?ref=securinglaravel.com#L10) and [DisableTwoFactorAuthentication](https://github.com/laravel/fortify/blob/1.x/src/Actions/DisableTwoFactorAuthentication.php?ref=securinglaravel.com) actions. P.s. I'd also suggest encrypting your 2FA *secret key* in the database, for added security in case of a data breach! 🤓 ****2FA** \- Two-Factor Authentication ****MFA** \- Multi-Factor Authentication ****2SV** \- Two-Step Verification These are all similar terms with subtle differences that relate to authenticating users with multiple authentication factors: something you know (passwords), something you have (physical device), something you are (biometrics). ****TOTP** \- Time-based One-Time Password A cryptographically secure method of generating a unique code every 30 seconds, to provide **something you have*, in the form of a physical device - i.e. your phone. --- ***If you found this security tip useful?* 👍** [*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.* ***Want to learn more?* 🤓** *Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support)*! Your support directly funds my security work in the Laravel community.* 🥰 **Need a second set of eyes on your code?** *Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.* *Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*