Trusted device recognition
The 'remember this device' option that skips repeat MFA on a known browser for a limited time, while risky actions still ask.
See it
What it is
Trusted device recognition remembers that a particular browser already completed MFA, then lets it skip repeat prompts for a limited time. Despite the name, a web app usually recognizes an opaque token in a cookie, not the physical laptop itself. The server stores a hash of that token beside the user, expiry, and device label.
Reach for it when mandatory MFA is creating needless friction on a person's own computer. A 30-day remembered-browser option is common, while a bank transfer, password change, or new recovery method should still trigger step-up authentication regardless of trust.
The gotcha is turning the cookie into a permanent MFA bypass. Make it random, revocable, short-lived, and separate from the login session. Revoke trusted-device records after password reset or suspected compromise, and do not use invasive browser fingerprinting as the credential. Fingerprints drift, collide, and create a privacy problem without proving possession of a secret.
Ask AI for it
Add a 'Trust this device for 30 days' option after successful MFA. Generate a 256-bit random token, store only its SHA-256 hash with user_id, created_at, expires_at, last_used_at, and revoked_at, and send the raw token in a separate Secure, HttpOnly, SameSite=Lax cookie. On login, skip routine MFA only when the token hash matches an active record for that user; rotate the token after use and never use browser fingerprinting as the credential. Ignore device trust for password, email, payout, API-key, MFA, and recovery changes. Add an account page that lists remembered browsers, supports individual revocation, and revokes every trusted-device token after password reset or global sign-out.