2FA in DSM — what it protects and what it doesn't

Your storageDRIVE account holds data that matters — photos, documents, backups. Enabling 2FA is mandatory setup. But two things up front that work differently in DSM than many people know from Google or Nextcloud:

1. DSM has no app passwords. You won’t find the menu — it doesn’t exist.
2. 2FA only protects part of your logins. SMB, FTPS, SFTP and WebDAV always run on your regular account password.

We’ll explain both here.

What 2FA protects — and what it doesn’t

2FA-protected (a code is required):

• DSM web login in the browser
• Synology apps (Drive Client, Drive Mobile, Photos): the 2FA code once at login, after that the app keeps its own device session

Not 2FA-protected (always run on the account password, a 2FA code is never requested):

• SMB (the drive in Finder/Explorer)
• FTPS
• SFTP
• WebDAV

The consequence: for the protocol logins, your account password is the only hurdle. A strong account password is therefore not a recommendation but a requirement — at least 16 characters, from your password manager.

Why there are no app passwords

Google and Nextcloud solve the protocol problem with app passwords: a separate password per app, individually revocable. Synology DSM doesn’t have that concept. All protocols use the same login.

What that means in practice:

• You can’t revoke a single protocol login — only change the account password. After that you have to enter the new password in all your tools (SMB and WebDAV mounts, FTPS scripts).
• For SFTP scripts there’s a better option: SSH key instead of password. Send us your public key via ticket and we’ll set it up — details in SFTP access.
• Passwords in scripts and config files: set file permissions to 600, never commit them to a Git repo.

Enabling 2FA

DSM web UI → avatar (top right) → Personal → Account → 2-Factor Authentication.

Click Enable → the wizard starts:

Step 1: Pick an authenticator app

Recommendations:

• Google Authenticator (iOS, Android) — simple, free
• Authy (iOS, Android, desktop) — multi-device sync
• 1Password / Bitwarden (multi-platform) — built into the password manager
• Aegis (Android) — open source

Step 2: Scan the QR code

DSM shows a QR code → scan it in the authenticator app → the app stores the secret.

Step 3: Verification

The authenticator app immediately generates a 6-digit code → type it into DSM → done.

Step 4: Save the recovery codes

DSM shows single-use recovery codes. Store them safely — password manager, or printed out in the safe.

If your phone is lost or the authenticator app breaks: one of these codes works as a login substitute for the 2FA code.

What changes after enabling

• Browser login: username + password, then the 2FA code. 6 digits, valid for 30 seconds.
• Synology apps (Drive Client, Drive Mobile, Photos): the code once at the next login, after that the app keeps running on its device session.
• SMB, FTPS, SFTP, WebDAV: nothing. They keep running on the account password, unchanged.

If you lose a device

Since there are no app passwords to revoke, it goes like this:

1. Change the account password — DSM web → avatar → Personal. All protocol logins using the old password are locked out immediately.
2. Open a ticket with us if you want to be certain: we terminate active sessions of the lost device on the server side.
3. If the 2FA secret was on the lost phone: log in with a recovery code and set up 2FA again.
4. Enter the new password on your remaining devices.

Recovery: 2FA lost

Worst case: phone gone, recovery codes gone too.

The fix:

1. Open a ticket with us (“2FA reset for my storageDRIVE account”)
2. We verify your identity (email address, contract details)
3. We reset 2FA on the server side
4. You log in with your account password and set up 2FA again

Turnaround: typically within 1 business day. Faster for urgent cases.

Recovery: account password forgotten

On the DSM login screen → Forgot password → email address → a reset link arrives.

If the email address is out of date too: open a ticket with us, same identity verification as above.

Security recommendations

Strong account password

At least 16 characters, mixed, from a password manager (1Password, Bitwarden, KeePass). Once more: this password also protects SMB, FTPS, SFTP and WebDAV — there is no second factor there.

Your email account needs its own 2FA

The email address on your account should have 2FA itself — otherwise anyone with access to your mailbox can use the password reset.

Don’t share your password

Not even within the family. Your storageDRIVE account belongs to exactly one person — whoever needs storage of their own orders their own plan, and then everyone has their own 2FA too.

Check the login history

Under Personal → Account → Login History you see all logins with timestamp, IP, success/failure. Taking a look every few months doesn’t hurt.

Frequently asked questions

I can’t find the “app passwords” menu — where is it? There isn’t one. DSM has no app passwords — you know the concept from Google or Nextcloud. On Synology, all protocol logins run on the account password.

Do SMB, SFTP and WebDAV still work when I enable 2FA? Yes, unchanged — with your regular account password. 2FA doesn’t apply to these protocols. Which is exactly why you need a strong password.

Can I disable 2FA for specific apps? Not necessary and not possible. 2FA covers the web login and the Synology apps. The protocol logins aren’t 2FA-protected anyway.

Push notification instead of a 6-digit code — is that possible? Yes, with Synology Secure SignIn (app on your phone) — login confirmation via push. Enable it under 2-Factor Authentication as an alternative to the TOTP code.

What if I switch authenticator apps? Have your recovery codes ready, then disable 2FA in DSM and set it up fresh with the new app.

Are 2FA activities logged? Yes. Under Personal → Account → Login History you see all logins with timestamp, IP, success/failure.

What if I lose 2FA — phone gone? Open a ticket with us. We reset 2FA for your account, you log in with your password and set up 2FA again. A reset only ever affects your own account.

What’s next

• First login to DSM
• Account and quota
• SFTP access