I'm wondering if there is a way to require 2-factor authentication on webpages and Android apps that don't have it by default. I am already using a password manager but I feel that this may not be enough and would like to also have 2-factor authentication for everything I'm using, if possible. Or is this overkill?


For apps, you would need a custom ROM on the device to prompt for this. But the risk/reward balance is a little off for devices.

There are services that can be used to add MFA to online services for a single-sign-on account, but that adds it for that 3rd party account, not the individual services account.

You cannot add MFA to something that isn't expecting it. It's like trying to add another password. If the service isn't expecting it, then who checks it to verify it passed? Who blocks access if it fails?


Simply not possible. Software is created by developers. If developers don't write code to require 2FA, they won't support it. 2FA has a cost, depending on the type of framework that you use. Not all companies want to invest in 2FA.

Other than politely writing to app/web developers, there is little you can do.

You could use your password manager intelligently. The PM holds your password, which is complex enough you can't remember it. If the PM enforces some kind of 2FA, e.g. it's a remote service using OTP, or is a local app requiring both a password and a fingerprint, then you have most sort of what you have been asking for.

  • First part is absolutely correct, but you are loosing me with 2FA on PM. This has nothing to do with 2FA on the app it is a different security domain. Someone having your password can still use it no matter how you protect your PM. So this is not even "sort of" what OP is asking for, not even close.
    – nethero
    Mar 24 at 10:59
  • It was meant to be a creative approach Mar 24 at 14:23

The answer to your question is no, it is not possible outside the context of your own device, which makes no sense, it would look like you have less trust to your own device than anyone else's.

As for overkill, yes it is an overkill. If your passwords are strong and unique then not having 2FA presents only one risk, someone may gain access to the app/website that doesn't have 2FA and gather the data or impersonate you in the context of this app/website, but this is a risk you accept by signing up for any service that doesn't offer strong 2FA.

There is a light in a tunnel, OATH is getting a lot of attention from developers and most of the services that are used as trust providers offer 2FA. I often use login with google only to use google 2FA in case the application does not offer it. I have a separate email for this purpose only.


As all other pointed out, this is not possible. However, you could choose extremely random passwords and use a cool password manager like https://www.themooltipass.com/, which gives you at least real 2FA locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.