diff --git a/Pipfile b/Pipfile
index fe89765..21bbbfa 100644
--- a/Pipfile
+++ b/Pipfile
@@ -17,6 +17,8 @@ django-favicon-plus = "*"
 django-meta = "*"
 django-redis-cache = "*"
 django-activeurl = "*"
+django-otp = "*"
+qrcode = "*"
 
 
 [dev-packages]
diff --git a/Pipfile.lock b/Pipfile.lock
index 6343165..341c2ef 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,7 +1,7 @@
 {
     "_meta": {
         "hash": {
-            "sha256": "6851dbdc8edfb1aab7ae43bc03ca775af0345e3f94ec032be0fb6f0e33aa2755"
+            "sha256": "26e312dcbf4057505a29d0fa5b15c856ba3ba45a7b9545e20cc682dbef43d7df"
         },
         "host-environment-markers": {
             "implementation_name": "cpython",
@@ -80,6 +80,13 @@
             ],
             "version": "==1.4"
         },
+        "django-otp": {
+            "hashes": [
+                "sha256:54f35d7a84d8c46f35d20b969f38ef1afc0fa7627e44c481e4ab5f66a8da187e",
+                "sha256:46fa6f2ae30a69a09bdc448b06a370c88d95fb0c3a9ba5771ca4d0d7740d56d7"
+            ],
+            "version": "==0.4.1.1"
+        },
         "django-redis-cache": {
             "hashes": [
                 "sha256:2b4e3510bbcaf3d331975717afd6f15a36fbaf7622504599d2727dc99f90c64d"
@@ -240,6 +247,13 @@
             ],
             "version": "==2017.2"
         },
+        "qrcode": {
+            "hashes": [
+                "sha256:60222a612b83231ed99e6cb36e55311227c395d0d0f62e41bb51ebbb84a9a22b",
+                "sha256:4115ccee832620df16b659d4653568331015c718a754855caf5930805d76924e"
+            ],
+            "version": "==5.3"
+        },
         "rcssmin": {
             "hashes": [
                 "sha256:ca87b695d3d7864157773a61263e5abb96006e9ff0e021eff90cbe0e1ba18270"
diff --git a/lemonauth/templates/lemonauth/login.html b/lemonauth/templates/lemonauth/login.html
index 4f762a1..d4efbdc 100644
--- a/lemonauth/templates/lemonauth/login.html
+++ b/lemonauth/templates/lemonauth/login.html
@@ -30,6 +30,7 @@
 		<div class="card-body">
 			{% form_field form.username %}
 			{% form_field form.password %}
+			{% form_field form.otp_token %}
 		</div>
 
 		<div class="card-footer">
diff --git a/lemonauth/views.py b/lemonauth/views.py
index a023a78..6aa6ba2 100644
--- a/lemonauth/views.py
+++ b/lemonauth/views.py
@@ -1,9 +1,11 @@
 from django.contrib.auth import views as auth_views
+from django_otp.forms import OTPAuthenticationForm
 from lemoncurry import breadcrumbs
 
 breadcrumbs.add(route='lemonauth:login', label='log in', parent='home:index')
 
 login = auth_views.LoginView.as_view(
+    authentication_form=OTPAuthenticationForm,
     template_name='lemonauth/login.html',
     redirect_authenticated_user=True,
 )
diff --git a/lemoncurry/settings/base.py b/lemoncurry/settings/base.py
index 089f3c3..e536ae0 100644
--- a/lemoncurry/settings/base.py
+++ b/lemoncurry/settings/base.py
@@ -66,6 +66,8 @@ INSTALLED_APPS = [
 
     'compressor',
     'django_activeurl',
+    'django_otp',
+    'django_otp.plugins.otp_totp',
     'favicon',
     'meta',
 
@@ -82,6 +84,7 @@ MIDDLEWARE = [
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django_otp.middleware.OTPMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
@@ -190,6 +193,10 @@ MEDIA_ROOT = os.path.join(STATIC_ROOT, 'media')
 # Settings specific to lemoncurry
 LEMONCURRY_SITE_NAME = '00dani.me'
 
+# django-otp
+# https://django-otp-official.readthedocs.io/en/latest/overview.html
+OTP_TOTP_ISSUER = LEMONCURRY_SITE_NAME
+
 # django-meta
 # https://django-meta.readthedocs.io/en/latest/settings.html
 META_SITE_PROTOCOL = 'https'