Duo Security explained: push, tokens, and what organizations pay for

You did not choose Duo. It chose you — on orientation day, when the university sent a text with an activation link. On the first shift, when the hospital's badge portal demanded a second factor before it would show a schedule. At the new job, when the laptop would not reach anything until an app was installed. Duo is the second factor somebody else picked, and for millions of people it is the only 2FA app on their phone.

Which is a shame, because the app is more useful than its job description. Here is what Duo actually is, how its pieces fit together, what it costs the organization, and the free personal-authenticator trick most of its users never notice.

What Duo actually is

Duo Security is an enterprise authentication platform, owned by Cisco and sold as Cisco Duo. The parent company describes it as cloud-based identity and access management that combines multi-factor authentication with single sign-on, device trust, and adaptive access policies (cisco.com). In plainer terms: an organization points Duo at the logins it controls — VPN, email, patient records, the student portal — and Duo stands in front of them asking for proof that the person typing the password is holding the right phone.

You meet it wherever institutions concentrate valuable data: universities, hospitals, banks, government agencies, employers of every size. The end user gets Duo Mobile, the phone app. The organization gets an admin panel full of policies. Those are two very different products, and the price tag attaches only to one of them.

The mechanics are the same open standard every authenticator uses — a shared secret and a clock — wrapped in an enterprise management layer. If your employer runs Microsoft 365 instead, the equivalent experience lands in the app covered by the Microsoft Authenticator guide.

Duo Push, and the number on your screen

Duo's signature method is Duo Push: a notification hits the phone, you look at it, you tap approve, no code typed anywhere. Duo's own product page pitches it as 2FA reduced to a single tap (duo.com).

The tap has been hardened since. Verified Duo Push adds number matching: the login screen on your computer displays a number, and the approval only works if you type that number into the phone first. It is the same defense Microsoft forced onto its push prompts, and it exists for the same reason — push-bombing, the attack where someone with your password floods your phone with approval requests at 2 a.m. until you tap one to make it stop. A reflex approval stops working when the prompt demands a number the sleeping person cannot see (authentication methods).

The app you already have is a personal authenticator

Here is the trick. Duo Mobile, the app your institution made you install, also works as a plain TOTP generator for accounts that have nothing to do with your organization. Duo's user guide says it directly: services like Instagram, Facebook, and Snapchat can be protected with mobile-generated passcodes, and "there is no need to sign-up for an organizational account on duo.com if you only want to protect your personal accounts" (guide.duo.com).

The routine is the same as any authenticator: turn on two-factor authentication at the service, choose authenticator app, then in Duo Mobile tap Add, choose to use the QR code scanner, and scan. Name the account, tap Save, and a passcode that expires every 30 seconds appears next to your work logins. It even accepts manual activation codes for sites that show a key instead of a QR.

Two warnings from Duo's own documentation. Third-party accounts cannot be exported out of Duo Mobile — there is no equivalent of moving your seeds to another app, so what you enroll there, you re-enroll if you ever leave. And Duo's support cannot recover those accounts for you: if you lose the phone and the backup, your way back in is each service's own recovery process (third-party accounts).

Fobs, keys, and bypass codes

Phones get lost, and not every user has a smartphone, so Duo keeps the old physical options alive.

A Duo token is a keyfob with a button and a screen. At the login prompt you click Enter a Passcode, press the token's button, and type the six digits it shows. Duo's user guide notes the failure mode honestly: tokens drift out of sync if the button is pressed too many times without the code being used, and fixing that is an administrator job (guide.duo.com). The one your help desk hands out is typically Duo's own D-100 fob, seeded by Duo and assigned to your account rather than programmable by you.

A YubiKey works too, in its passcode mode: click into the passcode field, tap the key, and it generates and submits the code in one gesture. Beyond that, Duo treats WebAuthn and FIDO2 security keys — and biometrics like Touch ID — as first-class authentication methods where policy allows them (authentication methods). A hardware key on your keychain beats a code on your phone for phishing resistance, a trade-off explored in the hardware security keys guide.

And then there is the escape hatch: the bypass code. A Duo administrator can generate a unique one-time code and read it to you over the phone or hand it over the help desk — the documented answer for the day your phone and your token are both somewhere else. Duo's guidance is blunt about its limits: bypass codes are a temporary authentication method, not a habit (help.duo.com).

Enrollment, the self-service portal, and Duo Restore

The first encounter is enrollment. Your organization sends an activation link — by email or SMS — or shows a QR code, you install Duo Mobile, tap through, and the account binds to the phone. From then on, logins alternate between the Duo prompt and whatever the policy demands.

Day-to-day maintenance happens in the self-service portal, My Settings & Devices, tucked behind a link on the Duo login prompt: add a new device, rename the old one, remove a phone you no longer carry. The correct order when changing phones is add-then-remove — the same discipline as every other authenticator, and the reason most 2FA lockouts are self-inflicted.

Changing phones has a designed path: Duo Restore. Duo Mobile backs up your accounts — on iOS to iCloud, on Android to Google Drive — and restores them to the new device. For Duo-protected work accounts, Instant Restore goes further and recovers them automatically when you set up a new phone: sign in with the same Google account on Android, pick the cloud backup the old device made, and enter the old device's password to prove the migration is yours (guide.duo.com, enhanced instant restore for Android). Third-party accounts ride along only if you enabled their backup, and they are protected by a separate recovery password. Forget that password, and the accounts are gone — Duo cannot decrypt them for you.

What the admin buys

The other side of the product is the reason an organization picks Duo over a free authenticator app: policy. The paid editions decide who may log in, from which networks, with what kind of device health — the Advantage tier, formerly Duo Access, layers policy and control over users, devices, and networks, endpoint device management, and risk-based authentication that weighs behavior and device signals before deciding how hard to challenge you (duo.com). Trusted networks, remembered devices, and step-up prompts all live in that layer. The user experiences it as inconsistency — sometimes a tap, sometimes a code, sometimes silence — which is precisely the point.

It is the same two-layer split as every other platform with account owners and account users, and it shows up in Zoom 2FA in an almost identical shape: a self-service layer for individuals, an enforcement layer for administrators.

What it costs

As of late 2026, Duo's editions run from free to nine dollars per user per month, and the entry point is more generous than most people assume. Duo Free covers teams of 10 or fewer. Above that: Essentials at $3 per user per month, Advantage at $6, and Premier at $9, with new customers getting a 30-day Advantage trial (duo.com).

For a 10-person operation — a clinic, a law office, a student group with a server — the free tier is a real option: the same Duo Push and token infrastructure the university uses, without the invoice. The pricing only matters to whoever owns the account. Everyone else meets Duo the way this post started: an activation link they did not ask for.

Frequently asked questions

Is Duo free?

For personal use, yes — Duo Mobile works as a third-party authenticator for your own accounts with no duo.com account and no payment. For organizations, Duo Free covers teams of up to 10 users; beyond that, paid editions run $3 to $9 per user per month as of late 2026. If your only exposure was an employer's enrollment link, you have been using a paid seat someone else bought.

Can I use Duo Mobile instead of Google Authenticator?

Yes. Duo Mobile generates standard TOTP passcodes for any service offering authenticator-app setup — tap Add, scan the QR code, and a 30-second code appears next to your work accounts. The trade is one-directional: Duo's documentation states third-party accounts cannot be exported, so if you later switch apps, you re-enroll at every service. Fine for a second phone. Think twice before making it your only one.

What happens if I lose the phone with Duo on it?

For Duo-protected work accounts, Duo Restore or Instant Restore recovers them on the new device — same Google account on Android, same iCloud backup on iOS — and the help desk can issue a bypass code if even that fails. Third-party accounts in Duo Mobile are your problem: they survive only if you enabled their backup and remember the recovery password. Duo support cannot restore them.

Why does Duo sometimes ask me to type a number?

That is Verified Duo Push, Duo's name for number matching. The login screen shows a number, and the phone asks you to type it before the approve button appears. The point is to defeat push-bombing: an attacker spamming approval requests cannot get a reflex tap when the prompt requires a number visible only on the screen the attacker is trying to reach. If the numbers never match, you are looking at someone else's login attempt.

Does Duo work with YubiKeys?

Yes, in two ways. In passcode mode, you tap the key into Duo's passcode field and it generates and submits a one-time code. Where the organization's policy allows, Duo also supports WebAuthn and FIDO2 security keys as phishing-resistant authentication methods, alongside biometrics like Touch ID. Which options appear at your login is an administrator decision, not yours.

The next time an enrollment link lands in your inbox, finish it — then look at that same app's Add button. It works for your own accounts too. And if you want to see what a code from any of your secrets looks like before committing it to any app, the guest generator at 2FA by DependsiT computes it in the page, no account required.