Ghost uses device verification and email 2FA for staff user login to Ghost Admin.

When any staff user signs in to your Ghost Admin area from a new or unrecognized device for the first time, they will be required to enter a 6-digit 2FA code, sent to their registered email address.

Site administrators can also configure Ghost to send email 2FA codes to staff users, as part of every staff user login, regardless of device.