Two-factor Authentication (TFA) and Drupal 11
The latest stable release, 8.x-1.13, declares a core version requirement of ^10 || ^11, which covers Drupal 11.
Two-factor authentication for Drupal sites. Drupal provides authentication via something you know -- a username and password while TFA module adds a second step of authentication with a check for something you have -- such as a code sent to (or generated by) your mobile phone. TFA is a base module for providing two-factor authentication for your Drupal site.
Key facts
- Project
- tfa
- Latest stable with Drupal 11 support
- 8.x-1.13 (16 Sept 2026)
- Core version requirement
- ^10 || ^11
- Maintenance status
- Actively maintained
- Reported installs
- 16,337
- Last synced from drupal.org
- 21 Sept 2026
Every field above comes from the drupal.org API. The Drupal 11 status is derived from the core version requirement across this project's releases.
Source: drupal.org/project/tfa
Related modules in Access control
CAPTCHA
ReadyAdd challenge-response tests to user-facing forms on your site to protect against spambot submissions. Further CAPTCHA types are supported via contrib modules.
captchaLatest stable 8.x-1.17244,588 sitesExternal Authentication
ReadyProvides a generic service for logging in and registering users that are authenticated against an external site or service and storing the authentication details.
externalauthLatest stable 2.0.13108,588 sitesField Permissions
ReadyThe Field Permissions module allows site administrators to set field-level permissions to edit, view and create fields on any entity. Features Enable field permissions on any entity, not just nodes. Role-based field permissions allowing different viewing patterned based on what access the user has. Author-level permissions allow viewing and editing of fields based on who the entity owner is.
field_permissionsLatest stable 8.x-1.569,071 sitesEU Cookie Compliance (GDPR Compliance)
ReadyProvides a GDPR cookie banner where you can gather consent from the user when the website stores cookies on their computer or otherwise handles their personal information.
eu_cookie_complianceLatest stable 8.x-1.2967,536 sitesMasquerade
ReadyAllows site administrators (or anyone with enough permissions) to switch users and surf the site as that user
masqueradeLatest stable 8.x-2.265,275 sitesView Unpublished
ReadyGives users with specific roles the ability to view unpublished content of certain content types.
view_unpublishedLatest stable 8.x-1.361,676 sites