Hi
Why doesn’t Zwift support Multi Factor Authentication or another name for it Two factor Authentication?
I’ve put this in General Discussion. Where really it should have its own category of account security.
Is it possible to for Zwift to enable better account security?
Cheers
Probably because the worst that could happen if someone hacks your account is they pay for your subscription.
Maybe they mess up your race score.
But most people don’t care about security that much, and the risk to effort ratio here is very low.
Agreed it’s a good idea.
Hi Zwift team,
I work in cybersecurity, and I want to highlight a serious issue that deserves attention. In 2025, multi-factor authentication (MFA) is not just a nice feature. It is an essential part of basic account security that users expect from any modern online service.
Zwift accounts are tied to more than just login credentials. They include payment information, personal fitness data, race history, and social connections. On top of that, many users link Zwift to other services like Strava, Garmin, TrainingPeaks, and Apple Health. These connections increase the overall risk because if someone gains access to a Zwift account, they may be able to exploit those integrations and reach even more sensitive personal data.
Zwift becomes the weakest link in the chain. An attacker does not need to break into your Strava or Garmin account if they can get in through Zwift and use its access to pivot further. This is exactly the kind of scenario MFA is designed to prevent.
Many platforms in the fitness and tech space already offer MFA, including Strava, Garmin, Apple, Google, and even Discord. Implementing even a basic MFA option using an authenticator app like Google Authenticator or Authy would provide a major boost in security without adding much friction for users.
This could start as an optional feature in account settings for those who want it. That alone would go a long way in helping users protect themselves.
Zwift is an incredible platform that motivates and connects athletes around the world. Adding MFA would show that you take user trust and security seriously, not just in terms of the ride experience but in protecting the entire ecosystem around it.
Thanks for all the work you do to keep Zwift growing and improving.
Just following up again on this. I did see a reply from someone at Zwift saying that this has been passed to the development team, and I appreciate that. But to be honest, that kind of response is very general and does not give the community any real insight into whether this is being taken seriously or prioritized.
This request has been raised multiple times over the past nine months or more, and MFA is now a basic expectation on platforms that handle user data. It is not a cutting-edge feature. It is standard security.
MFA is a simple and proven way to prevent account takeovers. The majority of account breaches today stem from password reuse or phishing, and MFA is one of the most effective ways to stop those attacks. Choosing not to implement it in 2025 can reasonably be viewed as negligent, especially for a platform that handles personal information and payment credentials.
If this is in progress, it would help to hear that directly. If it is not on the roadmap, then that is important to know as well. A vague status update leaves users guessing, which does not build trust.
Security should be part of the foundation, not an afterthought. If Zwift continues to delay addressing this, it risks losing user confidence. For many of us, Zwift is more than a game. It is part of our daily routine and connected to our broader digital life. Users expect the same level of care and protection they already get from other major platforms.
At this point, the community deserves a clear and specific update from the product or security team on whether MFA is being worked on or officially planned.