Login and two-factor authentication: secure and easy

Why login is the most important lock on your software

With a customer portal, a planning tool or an internal dashboard, there is often sensitive information behind the login screen. Think of customer data, invoices, quotes or employee data. The login screen is the front door. If it is weak, the rest of your security does little.

Most break-ins don't happen through complicated hacks. They happen through stolen or guessed passwords. People use the same password in several places. If it leaks from another service, criminals automatically try it everywhere. That is why a password alone is usually not enough for business software.

Which login methods are there?

There is no single best way to log in. Which one fits depends on who your users are and how often they log in. The most common options:

• Email and password: familiar and usable everywhere. But vulnerable if people choose weak or reused passwords.
• Magic link: the user enters their email address and receives a link to log in. No password to forget. Handy for customers who only log in now and then.
• Passkeys: log in with your fingerprint, face recognition or the PIN of your phone or laptop. There is no password that can leak, and it is fast.
• Single sign-on (SSO): log in with an existing business account, such as Microsoft or Google. Ideal for internal tools, because staff don't need an extra password.
• Login with a code by text message or email: simple, but less strong than an app or passkey.

You can combine methods. A common setup: staff log in via SSO, customers with email and password plus two-factor authentication, and anyone who wants to can add a passkey.

Two-factor authentication: which type should you choose?

Two-factor authentication comes in different forms. They are not all equally strong or equally pleasant to use.

• Authenticator app: an app such as Google Authenticator or Microsoft Authenticator generates a new code every 30 seconds. Strong and free for the user. They do need to scan a QR code once.
• Text message code: easy, everyone understands it. But SMS is less secure, partly because phone numbers are sometimes hijacked. On top of that, every text costs you a small amount.
• Code by email: low-threshold, but if someone's mailbox is hacked, the second step falls away.
• Passkey or security key: the strongest option. The phone or a physical key proves who you are, without typing over codes.

For most applications at small and medium-sized businesses, an authenticator app is a good default. Offer SMS as a fallback if you like, for people who don't want to install an app.

When do you really need to set up two-factor authentication?

Not every application needs the same level of strictness. A handy rule of thumb: the more sensitive the data and the more rights someone has, the stricter the login.

• Always 2FA for administrators and anyone who can view or change other people's data.
• Strongly recommended for personal data, financial data or medical information.
• Optional, but offered, for customers who only view their own orders or appointments.
• An extra check for risky actions, such as changing a bank account number or exporting all customers.

GDPR (AVG in Dutch, the European privacy law) doesn't prescribe a specific login method. It does require you to take appropriate measures to protect personal data. With sensitive data, 2FA is increasingly seen as the normal level. Unsure what is required in your situation? Check with a lawyer or look at the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Secure login without customers dropping off

A strict login that nobody uses doesn't help. People then look for workarounds, such as a shared account or a password on a sticky note. Here's how to keep it secure and pleasant:

• Remember trusted devices for a while, so people don't have to type a code every day.
• Explain in one sentence why you ask for 2FA. People accept an extra step more easily when they understand why.
• Make the recovery route clear. Provide recovery codes during setup for when someone loses their phone.
• Let password managers simply work. Don't block pasting into the password field.
• Don't require complicated password rules with mandatory characters. A long sentence works better than a short password with an exclamation mark.
• Give clear error messages, but don't reveal whether an email address exists or not.

Good UX design for your web application makes a real difference here. The login screen is often the first thing someone sees of your software.

Checklist: what belongs in a good login system?

Having software built? Go through these points with your developer:

• Passwords are stored encrypted using a modern method, never readable.
• After a number of failed attempts, there is a delay or temporary lockout.
• A secure 'forgot password' flow with a link that expires quickly.
• Two-factor authentication, mandatory for administrators.
• Roles and permissions: everyone only sees what they need.
• Automatic logout after a period of inactivity, especially on shared computers.
• A log of login attempts, so you can spot suspicious activity.
• An email notification when someone logs in from a new device.
• A quick way to block an account when an employee leaves.

Common mistakes with login and two-factor authentication

• Putting together your own login system without proven building blocks. Use tried-and-tested techniques instead of inventing something yourself.
• One shared account for the whole team. You never know who did what, and a departing colleague keeps access.
• Only offering 2FA and never making it mandatory for administrators.
• No recovery route, so you have to step in manually every time a phone is lost.
• Sessions that never expire, so someone stays logged in on a public computer.
• Only dealing with login at the end of the project. It affects roles, permissions and screens, so include it from the start.

You can read more about security in general in our article on secure software for SMEs.

Login and two-factor authentication in a Violexa web application

At Violexa we include login in the design from the very first conversation. We look at who your users are, which data they see and how often they log in. Based on that we choose the login method and the level of two-factor authentication. A portal for customers needs something different from a tool for your own team.

We build a custom web application from €1,799 excl. VAT (€2,177 incl. VAT) per project. For larger projects you get a fixed price up front, in writing, so you know where you stand.

Want to know which login setup suits your software? Book a free quickscan. In a 30-minute conversation, online or in person, we look at your plans. Afterwards you get short written advice with a price indication, with no obligation.

Frequently asked questions