Protect your account

Your tofa account is the key to your server: it decides who can sign in, what they can watch, and who administers the box. This page covers what you can turn on to protect it, what happens if you lose access, and how tofa is secured by design.

The short version#

• Add a passkey and sign in with Face ID, Touch ID, Windows Hello, or your device PIN. It is the strongest and most convenient option, and it can't be phished.
• Turn on the authenticator app if you want a six-digit code required after every sign-in.
• Save your recovery codes when you set up the authenticator. The setup won't let you skip this, and future you will be grateful.
• Every connection to your server is encrypted, even on your own network, and every request is checked against what that person is allowed to see.

Everything on this page lives in one place: sign in at app.tofa.tv, open Account, then Sign-in & security.

Passkeys#

A passkey is a sign-in credential stored on your device, unlocked with the same face, fingerprint, or PIN you already use. There is no code to type and nothing to be phished: a passkey only works on the real tofa sign-in page, so a look-alike site gets nothing.

Add one from Sign-in & security, then Add a passkey. You can add several, one per device or one in your password manager, and remove any of them later. The only thing we won't let you do is remove your last remaining way to sign in.

You keep your password as a fallback even after adding a passkey.

Two-step verification with an authenticator app#

If you turn on the authenticator, signing in takes your password or passkey plus a six-digit code from an authenticator app such as 1Password, Google Authenticator, or Authy. Someone who steals your password still can't get in.

Setup takes a minute: scan the QR code with your authenticator app, confirm one code, and save your recovery codes. From then on, every sign-in asks for the current code.

If you lose your authenticator#

First: a recovery code signs you in in place of the six-digit code. That is what they are for, and once you are in you can set up a new authenticator.

Lost the authenticator and the recovery codes? There is a last-resort path, and it is deliberately slow:

1. On the two-step screen, choose the recovery link. You need your password to start it.
2. We email your verified address. Nothing happens for 24 hours.
3. During that wait, every signed-in device shows a clear warning that a recovery is pending, with a one-click This wasn't me, cancel button.
4. After the wait, the email link lets you remove the lost authenticator. All sessions are signed out everywhere, and you sign back in and set up fresh.

The delay is the security. An attacker who somehow had your password would also need day-long access to your mailbox, while you get a full day of loud warnings and a cancel button on every device you own.

Passwords and resets#

Accounts require a verified email address before the first sign-in works. Password resets go through a one-time code sent to that address, and the code expires after a few minutes.

Passwords are handled by our identity service and stored only as salted hashes. We never see or store them in plaintext, and they never appear in logs.

If you ever suspect your account is compromised: change your password, then use Sign out of all devices on the Account page. That revokes every session on every device at once.

How tofa is secured by design#

A few things you get without turning anything on:

Encrypted everywhere, including your living room. Connections to tofa services and to your own server use TLS with real, automatically renewed certificates. That includes local playback on your home network: your server gets its own valid certificate, so there are no browser warnings and no plain-text fallback.

Every request is checked. Apps authenticate with short-lived, signed tokens rather than passwords. Access tokens rotate, and a stolen token that gets reused is detected and the whole session family is revoked. Media and image URLs carry their own scoped, short-lived credentials, so a copied link does not become a permanent backdoor.

Library access is enforced on the server, not in the app. When you share your server and limit someone to certain libraries, that limit is applied to every browse, every search, every image, and every stream. It is not a hidden menu item; the server refuses to serve what they weren't given.

Kicking someone out works immediately. Ending a playback session or removing a person takes effect on the next request, regardless of any token they still hold.

Claiming a server is local-only. A freshly installed server can only be claimed from the machine itself or its local network. Someone on the internet who stumbles onto an unclaimed tofa server cannot take it over. Headless and reverse-proxied installs use a setup token that only someone with access to the box can read.

Your server and our cloud authenticate each other. Every call between them is signed by keys generated on your machine, with protection against replayed requests.

Profile PINs are for the couch, not the vault. A profile PIN keeps kids out of your profile and your Continue Watching. It is stored hashed and attempts are rate-limited, but it is a household boundary, not account security. The account features above are the real lock.

Secrets stay out of logs. Passwords, tokens, and keys are scrubbed from server logs and from the diagnostic bundles you might send us.

What we don't do#

We don't run third-party trackers in the apps, and your server's own pages load no third-party scripts at all. What your server sends to our cloud, and what stays on your box, is documented in plain terms in Privacy and network behavior. We like testers who check.

Good habits#

• Add a passkey today, keep the password as backup.
• Turn on the authenticator for the account that owns your server. Owner accounts are the ones worth protecting most.
• Keep your account email current and its mailbox secure. Every recovery path runs through it.
• If a device is lost or sold, use Sign out of all devices and sign back in on the ones you keep.

Still stuck? Getting help & feedback covers what to send us.