diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html
new file mode 100644
index 000000000..798716ac4
--- /dev/null
+++ b/bookwyrm/templates/preferences/2fa.html
@@ -0,0 +1,55 @@
+{% extends 'preferences/layout.html' %}
+{% load i18n %}
+
+{% block title %}{% trans "Two Factor Authentication" %}{% endblock %}
+
+{% block header %}
+{% trans "Two Factor Authentication" %}
+{% endblock %}
+
+{% block panel %}
+<div class="block">
+    {% if success %}
+    <div class="notification is-success is-light">
+        <span class="icon icon-check" aria-hidden="true"></span>
+        <span>
+            {% trans "Successfully updated 2FA settings" %}
+        </span>
+    </div>
+    {% endif %}
+    {% if request.user.two_factor_auth %}
+    <p>Two Factor Authentication is active on your account.</p>
+    <a class="button is-danger" href="{% url 'disable-2fa' %}">{% trans "Disable 2FA" %}</a>
+    {% elif password_confirmed %}
+    <form name="confirm-2fa" action="{% url 'conf-2fa' %}" method="post" enctype="multipart/form-data">
+    {% csrf_token %}
+        <p>Scan the QR code with your authentication app and then enter the code from  your app below to confirm your app is set up.</p>
+        <div>
+            <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg">
+                {{ qrcode | safe }}
+            </svg>
+        </div>
+        <div class="field ">
+            <label class="label" for="id_otp">{% trans "Enter the code from your authenticator app:" %}</label>
+            {{ form.otp }}
+            {% include 'snippets/form_errors.html' with errors_list=form.current_password.errors id="desc_current_password" %}
+        </div>
+        <button class="button is-primary" type="submit">{% trans "Confirm" %}</button>
+    </form>
+    {% else %}
+    <p class="">
+        {% trans "You can make your account more secure by using Two Factor Authentication (2FA). This will require you to enter a one-time code using a phone app like <em>Authy</em>, <em>Google Authenticator</em> or <em>Microsoft Authenticator</em> each time you log in." %}
+    </p>
+    <p> {% trans "Confirm your password to begin setting up 2FA." %}</p>
+    <form name="confirm-password" action="{% url 'prefs-2fa' %}" method="post" enctype="multipart/form-data">
+            {% csrf_token %}
+        <div class="field">
+            <label class="label" for="id_password">{% trans "Password:" %}</label>
+            {{ form.password }}
+            {% include 'snippets/form_errors.html' with errors_list=form.current_password.errors id="desc_current_password" %}
+        </div>
+        <button class="button is-primary" type="submit">{% trans "Set up 2FA" %}</button>
+    </form>
+    {% endif %}
+</div>
+{% endblock %}
diff --git a/bookwyrm/templates/preferences/disable-2fa.html b/bookwyrm/templates/preferences/disable-2fa.html
new file mode 100644
index 000000000..dbb980852
--- /dev/null
+++ b/bookwyrm/templates/preferences/disable-2fa.html
@@ -0,0 +1,23 @@
+{% extends 'preferences/layout.html' %}
+{% load i18n %}
+
+{% block title %}{% trans "Disable 2FA" %}{% endblock %}
+
+{% block header %}
+{% trans "Disable 2FA" %}
+{% endblock %}
+
+{% block panel %}
+<div class="block">
+    <h2 class="title is-4">{% trans "Disable Two Factor Authentication" %}</h2>
+    <p class="notification is-danger is-light">
+        {% trans "Disabling 2FA will allow anyone with your username and password to log in to your account." %}
+    </p>
+
+    <form name="disable-2fa" action="{% url 'disable-2fa' %}" method="post">
+        {% csrf_token %}
+        <a class="button" href="{% url 'prefs-2fa' %}">{% trans "Cancel" %}</a>
+        <button type="submit" class="button is-danger">{% trans "Turn off 2FA" %}</button>
+    </form>
+</div>
+{% endblock %}
diff --git a/bookwyrm/templates/preferences/layout.html b/bookwyrm/templates/preferences/layout.html
index 27d91c480..ca63ec93d 100644
--- a/bookwyrm/templates/preferences/layout.html
+++ b/bookwyrm/templates/preferences/layout.html
@@ -19,6 +19,10 @@
                 {% url 'prefs-password' as url %}
                 <a href="{{ url }}"{% if url in request.path %} class="is-active" aria-selected="true"{% endif %}>{% trans "Change Password" %}</a>
             </li>
+            <li>
+                {% url 'prefs-2fa' as url %}
+                <a href="{{ url }}"{% if url in request.path %} class="is-active" aria-selected="true"{% endif %}>{% trans "Two Factor Authentication" %}</a>
+            </li>
             <li>
                 {% url 'prefs-delete' as url %}
                 <a href="{{ url }}"{% if url in request.path %} class="is-active" aria-selected="true"{% endif %}>{% trans "Delete Account" %}</a>