How to enable two-factor authentication on your Synology NAS
A Synology NAS often holds the most valuable data in a home or office: documents, photographs, backups, media libraries, and shared work files. A strong password is essential, but it can still be exposed through phishing, password reuse, malware, or a compromised device. Two-factor authentication adds a second checkpoint before DSM grants access.
Synology calls this feature 2-step verification or two-factor authentication, depending on the DSM version and account screen. The basic principle is the same: after entering your password, you provide a time-based code from an authenticator app or another approved security method.
The setup takes only a few minutes, but recovery planning matters just as much. If your phone is lost or reset, you need a safe way to regain access without weakening security for every user on the NAS.
Why two-factor authentication matters on a NAS
A NAS is frequently reachable from several devices and may be exposed to the internet through QuickConnect, port forwarding, VPN access, or third-party applications. An attacker who obtains a valid DSM password could potentially view files, create accounts, alter backups, or encrypt shared folders with ransomware.
Two-factor authentication makes a stolen password insufficient by itself. Most Synology installations use time-based one-time passwords, known as TOTP codes. These six-digit codes change at regular intervals and are generated locally by an authenticator app such as Authenticator, Authy, 1Password, or another compatible application.
This protection should be enabled for every account that can sign in to DSM, especially administrators. It does not replace software updates, firewall rules, secure remote access, or backups. Instead, it strengthens the login layer that protects the NAS management interface and connected services.
Prepare your Synology account and authenticator
Before starting, update DSM if a supported update is available and confirm that you can sign in with an administrator account. The exact labels differ between DSM 6 and DSM 7, so do not worry if your menu names are slightly different from the examples below.
Install an authenticator app on a trusted phone or tablet. If the device supports secure password management with built-in one-time passwords, that can be useful, but keep a separate recovery option as well. A phone that is always connected to the NAS is not required; TOTP codes normally work offline once the account has been enrolled.
Check the date and time settings on the NAS and your mobile device. Time-based codes depend on accurate clocks. In DSM, open the regional or time settings and enable automatic synchronization with a reliable NTP server. An incorrect clock can make valid codes appear to be rejected.
For general Linux administration and security background that can complement NAS hardening, consult this Linux security resource while reviewing your wider server environment.
Turn on 2FA in DSM
Sign in to DSM using the account you want to protect. In DSM 7, click the account icon in the upper-right corner, choose Personal, and open the Security area. Look for 2-factor authentication or a similarly named option, then select the command to enable or set it up.
In some DSM versions, the setting appears under Control Panel, User & Group, or an advanced account-security screen. Administrators may also find policy controls that require selected users or groups to use two-factor authentication. If the option is unavailable, verify that you are using a supported DSM release and that the account has permission to change its security settings.
DSM will display a QR code or a setup key. Open your authenticator app, add a new account, and scan the QR code. If scanning is not possible, enter the setup key manually. The app will then generate a temporary verification code. Enter the current code into DSM and submit it to finish enrollment.
Sign out and test the login immediately. Enter the username and password, wait for the second-factor prompt, and provide the new code. Testing in a private browser window helps confirm that the process works without relying on an existing session or a remembered browser.
| Security method | How it works | Main benefit | Important limitation |
|---|---|---|---|
| TOTP authenticator app | Generates rotating codes on a phone or password manager | Works without mobile service and is widely supported | Access depends on preserving the enrollment secret |
| Email verification | Sends a verification code to a configured email address | Convenient for users who cannot install an app | Email account security becomes part of NAS security |
| Security key | Uses a physical FIDO or compatible authentication device | Strong resistance to phishing and account takeover | Requires a supported DSM version, browser, and available key |
| Trusted device | Reduces prompts on a recognized browser or device | More convenient for frequent access | A stolen or shared device can weaken the benefit |
| Recovery code | Provides emergency access when the normal factor is unavailable | Helps recover an account after phone loss | Anyone who obtains the code may be able to bypass 2FA |
Save recovery codes securely
During enrollment, DSM may provide emergency or recovery codes. Treat these codes like spare keys to the NAS account. Store them in an encrypted password manager, a protected document vault, or a physically secure location that is separate from the phone running the authenticator app.
Do not save recovery codes in an unencrypted text file inside a NAS shared folder. If ransomware, unauthorized access, or accidental deletion affects that folder, the recovery material may disappear or become available to an attacker. Avoid taking an unprotected screenshot that automatically syncs to a broad photo or cloud account.
After enabling 2FA, confirm how account recovery works in your DSM version. Some recovery workflows require administrator assistance, while others allow a user to use a recovery code or alternate verification method. Administrators should document a controlled process for helping staff without disabling two-factor authentication permanently.
If you replace your phone, transfer the authenticator entries before wiping the old device. When the new device works, remove the old enrollment where DSM provides that option. If the old phone was lost or stolen, change the account password and review active sessions, trusted devices, and connected applications as soon as possible.
Apply the policy to other users
Protecting only one administrator account leaves another route open if other privileged users can still log in with passwords alone. Review User & Group in DSM and identify accounts with administrator privileges, remote access, backup permissions, or access to sensitive shared folders.
Depending on the DSM release, an administrator can require two-factor authentication for specific users or groups. Enforcing the policy gradually is often practical: start with administrators, test the recovery process, and then extend the requirement to ordinary users. Communicate the change before enforcement so users know how to install an authenticator and store recovery information.
Service accounts and applications need special attention. Some backup tools, media applications, file synchronization clients, and API integrations may not support interactive 2FA prompts. Do not simply share a personal administrator account with an application. Use a dedicated account with the minimum required permissions, and follow Synology’s current guidance for app passwords, tokens, or supported authentication methods.
Test remote access and related services
After enabling two-factor authentication, test every normal access path: DSM in a browser, Synology Drive, mobile applications, Hyper Backup tasks, VPN access, and any reverse proxy or domain-based connection. A successful browser login does not guarantee that every client handles the new authentication flow correctly.
Avoid exposing DSM directly to the internet through unnecessary port forwarding. QuickConnect, a properly configured VPN, or a secure reverse proxy can reduce exposure, but each option still needs current firmware, strong account controls, and monitoring. Two-factor authentication protects credentials; it does not fix an outdated package or a vulnerable service.
Review DSM logs after setup. Look for repeated failed logins, unfamiliar IP addresses, unexpected account changes, or sign-ins at unusual times. Enable notifications where appropriate, and make sure alerts are delivered to an account that is itself protected with a strong password and two-factor authentication.
Build a dependable protection routine
Use these practices when rolling out two-factor authentication across a home or business NAS:
- Enable 2FA first for every administrator and any account with remote access.
- Keep recovery codes in a secure password manager or protected offline location.
- Verify the NAS clock, mobile device time, and authenticator codes before troubleshooting failed logins.
- Test DSM, mobile, synchronization, and backup clients after enabling the policy.
- Review users, active sessions, login logs, shared-folder permissions, and DSM updates regularly.
Two-factor authentication is most effective when combined with least-privilege permissions and an independent backup strategy. A second NAS, external drive, or cloud backup should not remain permanently exposed through the same credentials and network path as the primary system. Use versioning or immutable retention where possible so a compromised account cannot instantly erase every copy.
Keep your Synology login resilient
Enabling two-factor authentication on your Synology NAS turns a password-only login into a layered defense. Set it up for your own account, protect other privileged users, preserve recovery codes, and test the services that matter before considering the work finished.
Sign in to DSM today, enroll a trusted authenticator, and record the recovery details in a secure place. Then review remote access, account permissions, and backup jobs so your NAS remains protected when a password is exposed or a device is lost.