diff --git a/docs/linkr/linkr/getting-started.mdx b/docs/linkr/linkr/getting-started.mdx
index 6cbcee738..c8e91bb55 100644
--- a/docs/linkr/linkr/getting-started.mdx
+++ b/docs/linkr/linkr/getting-started.mdx
@@ -148,6 +148,7 @@ OTG 口同时负责向灵控供电和向被控机注入键鼠信号，请使用
 | ---------------- | -------------------- | ---------------------------------------------------- |
 | 连接 Wi-Fi       | 左侧栏 → 网络设置    | [用户页面指南](./usage)                              |
 | 修改设备名称     | 系统设置 → 设备名称  | [用户页面指南](./usage)                              |
+| 开启双重验证     | 系统设置 → 安全      | [双重验证（2FA）](./two-factor-authentication)       |
 | 远程访问（外网） | 高级设置 → Tailscale | [Tailscale 远程访问](./advanced-usage/remote-access) |
 | 固件升级         | 系统设置 → 系统更新  | [固件更新](./firmware-update)                        |
 
@@ -210,3 +211,4 @@ OTG 口同时负责向灵控供电和向被控机注入键鼠信号，请使用
 - [Tailscale 远程访问](./advanced-usage/remote-access) — 外网安全访问
 - [Wake on LAN](./advanced-usage/wake-on-lan) — 远程唤醒被控主机
 - [访问令牌](./access-token) — API 访问与自动化
+- [双重验证（2FA）](./two-factor-authentication) — 为 Web 登录增加验证码保护
diff --git a/docs/linkr/linkr/product-introduction.mdx b/docs/linkr/linkr/product-introduction.mdx
index 40302eb0b..2e71c159e 100644
--- a/docs/linkr/linkr/product-introduction.mdx
+++ b/docs/linkr/linkr/product-introduction.mdx
@@ -122,6 +122,7 @@ title: 产品概述
 | Web 远程控制台 | 视频、键鼠、截图、录屏、虚拟键盘等 | [用户页面指南](./usage)                              |
 | Tailscale      | 内置 VPN，无需公网 IP 远程访问     | [Tailscale 远程访问](./advanced-usage/remote-access) |
 | Wake on LAN    | 局域网魔术包唤醒被控主机           | [Wake on LAN](./advanced-usage/wake-on-lan)          |
+| 双重验证       | 使用身份验证器保护 Web 登录         | [双重验证（2FA）](./two-factor-authentication)       |
 | 访问令牌       | API Key，支持截图与控制接口        | [访问令牌](./access-token)                           |
 
 ## 相关链接
@@ -129,4 +130,5 @@ title: 产品概述
 - [上手指南](./getting-started)
 - [Tailscale 远程访问](./advanced-usage/remote-access)
 - [Wake on LAN](./advanced-usage/wake-on-lan)
+- [双重验证（2FA）](./two-factor-authentication)
 - [常见问题](./getting-started#常见问题)
diff --git a/docs/linkr/linkr/two-factor-authentication.mdx b/docs/linkr/linkr/two-factor-authentication.mdx
new file mode 100644
index 000000000..20e10c923
--- /dev/null
+++ b/docs/linkr/linkr/two-factor-authentication.mdx
@@ -0,0 +1,124 @@
+---
+id: two-factor-authentication
+sidebar_position: 4
+title: 双重验证（2FA）
+---
+
+# 双重验证（2FA）
+
+瑞莎灵控（Radxa Linkr）支持基于身份验证器应用的双重验证。开启后，登录时除了用户名和密码，还必须输入身份验证器生成的 6 位验证码。即使密码泄露，其他人也无法仅凭密码登录设备。
+
+## 准备工作
+
+开始前，请准备一台已安装身份验证器应用的手机或其他可信设备。身份验证器需要支持扫描二维码或手动输入密钥。
+
+常用的兼容应用包括：
+
+- [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=zh-Hans)
+- [Microsoft Authenticator](https://support.microsoft.com/zh-cn/authenticator/about-microsoft-authenticator)
+- [Bitwarden Authenticator](https://bitwarden.com/help/bitwarden-authenticator/)
+- [1Password](https://support.1password.com/one-time-passwords/)
+
+Linkr 不限定具体应用，其他支持标准 TOTP（基于时间的一次性密码）、能够扫描二维码或手动输入密钥的身份验证器也可以使用。
+
+:::warning 重要
+当前版本不会生成恢复码。开启前请妥善保管身份验证器及 2FA 密钥；请勿通过聊天工具、邮件或截图向他人泄露密钥和二维码。
+:::
+
+## 开启双重验证
+
+1. 登录灵控 Web 管理界面。
+2. 点击左侧边栏的 **系统设置**。
+3. 展开 **安全** 面板，在 **双重验证** 右侧点击 **开启**。
+4. 使用身份验证器扫描页面中的二维码。
+   - 若二维码不可用，请复制页面显示的 **密钥**，并在身份验证器中手动添加。
+5. 在灵控页面输入身份验证器当前显示的 6 位验证码。
+6. 点击 **确认**。页面提示“双重验证已开启”后，配置即生效。
+
+在 **系统设置** 中展开 **安全** 面板：
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-settings.webp"
+    alt="系统设置中的安全面板"
+    style={{ width: "100%", maxWidth: "560px" }}
+  />
+</div>
+
+点击 **开启** 后，使用二维码或密钥在身份验证器中添加 Linkr：
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-setup.webp"
+    alt="双重验证开启配置"
+    style={{ width: "100%", maxWidth: "500px" }}
+  />
+</div>
+
+:::tip
+建议在退出当前会话前，确认身份验证器中的 Linkr 条目能够持续生成验证码，并将密钥保存在密码管理器等安全位置。
+:::
+
+## 使用双重验证登录
+
+开启 2FA 后，登录分为两个阶段：
+
+1. 在登录页输入用户名和密码，点击 **登录**。
+2. 页面提示需要 2FA 验证，并显示 **验证码** 输入框。
+3. 打开身份验证器，输入当前的 6 位验证码。
+4. 点击 **验证并登录**。
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-login.webp"
+    alt="双重验证登录验证码输入框"
+    style={{ width: "100%", maxWidth: "900px" }}
+  />
+</div>
+
+验证码只能输入 6 位数字，并会随时间更新。如果验证失败，请等待身份验证器生成下一组验证码后重试。若停留在验证码页面时间过长，请刷新登录页，重新输入用户名和密码后再验证。
+
+## 关闭双重验证
+
+1. 登录灵控 Web 管理界面。
+2. 进入 **系统设置**，展开 **安全** 面板。
+3. 在 **双重验证** 右侧点击 **关闭**。
+4. 阅读确认提示，然后点击 **确认**。
+
+关闭成功后，后续登录不再要求输入验证码。身份验证器中原有的 Linkr 条目也将不再用于登录，可自行删除。
+
+## 安全建议
+
+- 将 2FA 密钥保存在密码管理器等受保护的位置，不要与登录密码存放在同一条未加密记录中。
+- 不要共享二维码、密钥或验证码；任何获得密钥的人都可以生成有效验证码。
+- 更换手机前，先使用已保存的密钥在新设备中添加账户，并确认新设备能生成有效验证码。
+- 在共享设备上操作后及时退出登录，不要让浏览器保存敏感信息。
+
+## 常见问题
+
+### 验证码始终验证失败
+
+- 确认输入的是身份验证器中 Linkr 对应条目的验证码。
+- 验证码应为 6 位数字；若即将刷新，请等待下一组验证码后再输入。
+- 确保运行身份验证器的设备已启用自动设置日期和时间。设备时间偏差过大会导致验证码无效。
+- 若曾重新打开开启页面，请使用页面当前显示的二维码或密钥重新添加账户，旧配置可能无法完成开启。
+
+### 二维码无法显示或扫描
+
+点击密钥右侧的复制按钮，将密钥复制到身份验证器中手动添加。如果浏览器无法访问剪贴板，请选中密钥后手动复制。
+
+### 更换手机后如何继续使用
+
+如果仍保留原手机，可在新手机的身份验证器中使用已备份的密钥添加账户，并验证其生成的验证码。如果没有备份密钥但仍能登录，可先在 **系统设置 → 安全** 中关闭 2FA，再使用新手机重新开启。
+
+### 手机丢失且无法生成验证码
+
+当前版本没有恢复码，也不能从登录页绕过 2FA：
+
+- 若还有可用的已登录会话，请立即进入 **系统设置 → 安全** 关闭 2FA，再使用新的身份验证器重新开启。
+- 若有其他已配置相同密钥的身份验证器，请使用该身份验证器生成验证码。
+- 若以上方式均不可用，请长按设备的 **Fn 按键** 10 秒重置设备。重置完成后，请重新初始化账号并配置 2FA。
+
+:::caution
+重置设备会中断当前连接。执行前请确认已无其他恢复方式，并准备好重新初始化设备。
+:::
diff --git a/docs/linkr/linkr/usage.mdx b/docs/linkr/linkr/usage.mdx
index 4c9efbb77..626f480cf 100644
--- a/docs/linkr/linkr/usage.mdx
+++ b/docs/linkr/linkr/usage.mdx
@@ -434,7 +434,7 @@ sidebar_position: 2
 
 ## 系统设置
 
-包含：用户信息与密码、API Key、语言、设备名、设备重置、系统更新。
+包含：用户信息与密码、双重验证、API Key、语言、设备名、设备重置、系统更新。
 
 ### 用户信息与密码
 
@@ -472,6 +472,16 @@ sidebar_position: 2
 
 :::
 
+### 双重验证
+
+功能：
+
+- 使用身份验证器应用扫描二维码或手动输入密钥
+- 开启后，登录时需额外输入 6 位验证码
+- 可在安全面板中关闭双重验证
+
+详细配置与恢复注意事项请参考 [双重验证（2FA）](/linkr/linkr/two-factor-authentication)。
+
 ### 语言设置
 
 作用：
diff --git a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/getting-started.mdx b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/getting-started.mdx
index 729400056..8490bd41f 100644
--- a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/getting-started.mdx
+++ b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/getting-started.mdx
@@ -148,6 +148,7 @@ After completing the first connection, we recommend configuring the following as
 | -------------------------------- | ------------------------------- | --------------------------------------------------------- |
 | Connect to Wi-Fi                 | Left sidebar → Network Settings | [User Interface Guide](./usage)                           |
 | Change device name               | System Settings → Device Name   | [User Interface Guide](./usage)                           |
+| Enable two-factor authentication | System Settings → Safety        | [Two-Factor Authentication](./two-factor-authentication)  |
 | Remote access (external network) | Advanced Settings → Tailscale   | [Tailscale Remote Access](./advanced-usage/remote-access) |
 | Firmware upgrade                 | System Settings → System Update | [Firmware Update](./firmware-update)                      |
 
@@ -210,3 +211,4 @@ For more questions, see [FAQ](#faq).
 - [Tailscale Remote Access](./advanced-usage/remote-access) — Secure remote access
 - [Wake on LAN](./advanced-usage/wake-on-lan) — Remotely wake the target host
 - [Access Tokens](./access-token) — API access and automation
+- [Two-Factor Authentication (2FA)](./two-factor-authentication) — Add verification-code protection to web sign-in
diff --git a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/product-introduction.mdx b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/product-introduction.mdx
index 81e5c8ca5..01122be01 100644
--- a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/product-introduction.mdx
+++ b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/product-introduction.mdx
@@ -122,6 +122,7 @@ In addition to the hardware remote control capabilities, the Linkr firmware and
 | Web remote console | Video, keyboard/mouse, screenshots, recording, virtual keyboard, etc. | [User Interface Guide](./usage)                           |
 | Tailscale          | Built-in VPN, access the device remotely without a public IP          | [Tailscale Remote Access](./advanced-usage/remote-access) |
 | Wake on LAN        | Send a magic packet on the LAN to wake the target host                | [Wake on LAN](./advanced-usage/wake-on-lan)               |
+| Two-factor authentication | Protect web sign-in with an authenticator app                   | [Two-Factor Authentication](./two-factor-authentication)   |
 | Access tokens      | API keys that support screenshot and control endpoints                | [Access Tokens](./access-token)                           |
 
 ## Related Links
@@ -129,4 +130,5 @@ In addition to the hardware remote control capabilities, the Linkr firmware and
 - [Getting Started Guide](./getting-started)
 - [Tailscale Remote Access](./advanced-usage/remote-access)
 - [Wake on LAN](./advanced-usage/wake-on-lan)
+- [Two-Factor Authentication](./two-factor-authentication)
 - [FAQ](./getting-started#faq)
diff --git a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/two-factor-authentication.mdx b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/two-factor-authentication.mdx
new file mode 100644
index 000000000..fad246359
--- /dev/null
+++ b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/two-factor-authentication.mdx
@@ -0,0 +1,124 @@
+---
+id: two-factor-authentication
+sidebar_position: 4
+title: Two-Factor Authentication (2FA)
+---
+
+# Two-Factor Authentication (2FA)
+
+Radxa Linkr supports two-factor authentication through an authenticator app. After 2FA is enabled, signing in requires both your username and password and a six-digit code from the authenticator. A password alone is no longer sufficient to access the device.
+
+## Before You Start
+
+Install an authenticator app on a phone or another trusted device. The app must support scanning a QR code or entering a secret manually.
+
+Common compatible applications include:
+
+- [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en)
+- [Microsoft Authenticator](https://support.microsoft.com/en-us/authenticator/about-microsoft-authenticator)
+- [Bitwarden Authenticator](https://bitwarden.com/help/bitwarden-authenticator/)
+- [1Password](https://support.1password.com/one-time-passwords/)
+
+Linkr does not require a specific application. Any other authenticator that supports standard TOTP (time-based one-time passwords) and can scan a QR code or accept a secret manually can also be used.
+
+:::warning Important
+The current version does not provide recovery codes. Keep the authenticator and 2FA secret safe. Do not disclose the secret or QR code through chat, email, or screenshots.
+:::
+
+## Enable 2FA
+
+1. Sign in to the Linkr web interface.
+2. Select **System Settings** in the left sidebar.
+3. Expand **Safety**, then click **Enable** next to **Two-factor authentication**.
+4. Scan the QR code with your authenticator app.
+   - If the QR code is unavailable, copy the displayed **Secret** and add it to the authenticator manually.
+5. Enter the current six-digit code from the authenticator in the Linkr interface.
+6. Click **Confirm**. The setup is active when Linkr reports that two-factor authentication has been enabled.
+
+Expand **Safety** under **System Settings**:
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-settings.webp"
+    alt="Safety panel under System Settings"
+    style={{ width: "100%", maxWidth: "560px" }}
+  />
+</div>
+
+After clicking **Enable**, add Linkr to the authenticator with the QR code or secret:
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-setup.webp"
+    alt="Two-factor authentication setup"
+    style={{ width: "100%", maxWidth: "500px" }}
+  />
+</div>
+
+:::tip
+Before signing out, confirm that the Linkr entry in your authenticator continues to generate codes. Store the secret in a secure location such as a password manager.
+:::
+
+## Sign In with 2FA
+
+After 2FA is enabled, signing in has two stages:
+
+1. Enter your username and password on the sign-in page, then click **Login**.
+2. Linkr asks for 2FA verification and displays the **Verification code** field.
+3. Open your authenticator and enter the current six-digit code.
+4. Click **Verify and sign in**.
+
+<div style={{ textAlign: "center" }}>
+  <img
+    src="/img/linkr/2fa-login.webp"
+    alt="Verification code field during two-factor sign-in"
+    style={{ width: "100%", maxWidth: "900px" }}
+  />
+</div>
+
+The field accepts six digits, and codes change periodically. If verification fails, wait for the authenticator to generate the next code and try again. If the verification page has been open for an extended period, refresh the sign-in page, enter the username and password again, and then retry verification.
+
+## Disable 2FA
+
+1. Sign in to the Linkr web interface.
+2. Open **System Settings** and expand **Safety**.
+3. Click **Disable** next to **Two-factor authentication**.
+4. Review the confirmation message, then click **Confirm**.
+
+Future sign-ins no longer require a verification code. The old Linkr entry in your authenticator is no longer used and can be deleted.
+
+## Security Recommendations
+
+- Store the 2FA secret in a protected location such as a password manager. Do not keep it with the login password in the same unencrypted record.
+- Never share the QR code, secret, or verification codes. Anyone with the secret can generate valid codes.
+- Before replacing your phone, add the account to the new device with the saved secret and verify that it generates valid codes.
+- Sign out after using Linkr on a shared device, and do not allow the browser to save sensitive information.
+
+## Troubleshooting
+
+### Verification Always Fails
+
+- Make sure you are using the code from the correct Linkr entry in the authenticator.
+- The code must contain six digits. If it is about to change, wait for the next code before entering it.
+- Enable automatic date and time on the device running the authenticator. A significant clock difference causes codes to be rejected.
+- If you reopened the setup panel, add the account again using the QR code or secret currently displayed. An earlier setup may no longer complete activation.
+
+### The QR Code Is Missing or Cannot Be Scanned
+
+Use the copy button next to the secret and enter the secret manually in the authenticator. If the browser cannot access the clipboard, select and copy the secret manually.
+
+### Moving to a New Phone
+
+If you still have the old phone, add the account to the new authenticator with your saved secret and verify its codes. If you did not save the secret but still have an active Linkr session, disable 2FA under **System Settings → Safety**, then enable it again with the new phone.
+
+### The Authenticator Is Lost
+
+The current version has no recovery codes, and 2FA cannot be bypassed from the sign-in page:
+
+- If an active signed-in session is still available, immediately open **System Settings → Safety**, disable 2FA, and then enable it again with a new authenticator.
+- If another authenticator has been configured with the same secret, use it to generate a verification code.
+- If neither option is available, press and hold the device's **Fn button** for 10 seconds to reset the device. After the reset, initialize the account and configure 2FA again.
+
+:::caution
+Resetting the device interrupts the current connection. Confirm that no other recovery method is available and be prepared to initialize the device again.
+:::
diff --git a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/usage.mdx b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/usage.mdx
index 6c2707a9a..dd630f7dd 100644
--- a/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/usage.mdx
+++ b/i18n/en/docusaurus-plugin-content-docs/current/linkr/linkr/usage.mdx
@@ -407,7 +407,7 @@ Purpose:
 
 ## System Settings
 
-Includes: user information and password, API key, language, device name, device reset, system update.
+Includes: user information and password, two-factor authentication, API key, language, device name, device reset, system update.
 
 ### User Information and Password
 
@@ -445,6 +445,16 @@ Purpose:
 
 :::
 
+### Two-Factor Authentication
+
+Functions:
+
+- Scan a QR code with an authenticator app or enter the secret manually
+- Require an additional six-digit code during sign-in after 2FA is enabled
+- Disable two-factor authentication from the Safety panel
+
+For setup and recovery considerations, see [Two-Factor Authentication (2FA)](/linkr/linkr/two-factor-authentication).
+
 ### Language Settings
 
 Purpose:
diff --git a/static/img/linkr/2fa-login.webp b/static/img/linkr/2fa-login.webp
new file mode 100644
index 000000000..339f4989b
Binary files /dev/null and b/static/img/linkr/2fa-login.webp differ
diff --git a/static/img/linkr/2fa-settings.webp b/static/img/linkr/2fa-settings.webp
new file mode 100644
index 000000000..5008933c9
Binary files /dev/null and b/static/img/linkr/2fa-settings.webp differ
diff --git a/static/img/linkr/2fa-setup.webp b/static/img/linkr/2fa-setup.webp
new file mode 100644
index 000000000..b84693a8a
Binary files /dev/null and b/static/img/linkr/2fa-setup.webp differ