Security · Available on All tiers

Your monitoring account is worth protecting too.

TOTP authenticator-app MFA with single-use recovery codes, on every account, at no extra tier — because the tool watching your infrastructure shouldn't be the weak link.

Start Free → See pricing

Free forever plan, no card required.

Why it matters

Two-factor authentication

Uptime monitoring accounts have access to your alert contacts, your status page, and often webhook secrets. An account takeover isn't just annoying — it's a way for an attacker to silence your alerts before doing something worse. Someone who gets into a monitoring account with no second factor could quietly disable the checks watching your most sensitive endpoints, delete the alert contacts who'd otherwise get paged, or post a fake "scheduled maintenance" notice to your public status page to buy themselves time while they do something else entirely. It's a low-profile target precisely because it doesn't look like the kind of account worth breaking into — until you consider that it's often the first thing to notice when something else goes wrong, which makes it exactly the account an attacker would want to compromise first. It's a small target with an outsized blast radius, which is exactly the kind of account worth locking down first. Treating it as optional is a bit like locking the front door but leaving the garage wide open.

No paywall on security

Full TOTP MFA on Free, not gated behind a paid tier the way some tools do it. Security shouldn't be the upsell — an account on the free plan holds exactly the same alert contacts, webhook secrets and status-page access as one on Team, so it gets exactly the same protection with nothing held back. It's a deliberate stance: the account protecting your infrastructure shouldn't itself be the weakest link in it. It reflects a simple principle: the most important accounts shouldn't be the ones asked to make do with less protection.

Recovery codes included

Single-use codes so a lost phone or reset device never locks you out permanently. Each code works exactly once and then burns itself, so even if a set of recovery codes were ever seen by someone else, using one to break in would immediately signal that something's wrong, since it would already be spent when the real owner tries it. It's a small piece of setup that pays for itself the one time a phone actually gets lost. It removes the single biggest reason people avoid turning 2FA on in the first place.

Standard authenticator apps

Works with any TOTP app you already use — no proprietary app to install and manage. Google Authenticator, Authy, 1Password, or whatever your team has already standardized on all work the same way, because TOTP is an open standard, not an UptimeLuna-specific requirement that adds one more app to everyone's phone. There's nothing new to learn, just a code from an app most people already have installed. There's no vendor lock-in to a specific authenticator brand either.

FAQ

Two-factor authentication, answered.

Is 2FA a paid feature?

No — full TOTP authenticator-app MFA is available on Free, not gated behind a paid tier the way some tools do it. There's no upsell here: an account on the free plan gets exactly the same login protection as one paying for Team. It's one of the few security controls here that costs literally nothing to turn on. It's simply there, on by default in the settings, waiting to be turned on.

What if I lose my phone?

Single-use recovery codes are issued when you enable 2FA, so a lost phone or reset device doesn't lock you out permanently. Store them somewhere safe when they're generated — a password manager works well — since each code only works once and there's no way to view them again after the fact. Generating a fresh set after using one is just as easy, whenever that becomes necessary. It's the kind of safety net that costs nothing until the one day it's needed.

Can I require 2FA for my whole team?

Team-tier owners can require two-factor authentication for every member before they can access the organization, closing the gap a single unprotected teammate would otherwise leave open. It's an org-wide setting an Owner flips once, rather than something that depends on every individual teammate remembering to turn it on themselves. It closes the exact gap a well-meaning but unprotected teammate could otherwise leave wide open. It's a quiet but meaningful upgrade to the whole organization's security posture.

Get Started

Two-factor authentication. Free, starting now.

Start Free →