Fortinet FortiToken Mobile.
Strong MFA Without the Extra Hardware.
FortiToken Mobile turns any iOS, Android, or Windows device into a certified two-factor authentication
token. Backed by FortiGuard and fully integrated with FortiGate and FortiAuthenticator, it delivers
push-notification approval and OATH-compliant one-time passwords without requiring users to carry a separate
key fob. Perpetual licensing by user count keeps costs predictable, with no annual renewal fees.
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
FortiToken Mobile at a Glance
Authentication
FortiToken Mobile generates both time-based (TOTP) and event-based (HOTP) one-time passwords per RFC
6238 and RFC 4226. Push notifications deliver login details directly to the user's phone for one-tap
approval or denial, so users never need to type an OTP manually unless they prefer to.
Platform Support
The app runs on iOS (iPhone, iPod Touch, iPad, and Apple Watch), Android, Windows 10, and Windows 11.
WiFi-only devices are fully supported for over-the-air token activation. FortiToken Mobile is Mobile
Application Security Certified v3.1 for both Android and iOS.
Security and Privacy
Token seeds are bound to the registered device, preventing copying to another phone. Self-erase
brute-force protection locks the app after repeated failed attempts. PIN, fingerprint, and Face ID
access guard the app. FortiToken Mobile cannot change phone settings, access your camera without
permission, or read your emails.
Fortinet Integration
FortiToken Mobile integrates directly with FortiGate next-generation firewalls and FortiAuthenticator
for SSL VPN, IPsec VPN, captive portal, and admin login. FortiGuard manages secure token provisioning,
keeping seeds encrypted at rest and in transit. No external RADIUS server is required when using
FortiGate as the validation server.
FortiToken Mobile or FortiToken 210?
Need hardware tokens instead of a mobile app? Compare FortiToken Mobile with the FortiToken 210 key fob
to find the right fit for your organization and users.
FortiToken Mobile is an OATH-compliant one-time password app for iOS, Android, and
Windows. After activation via QR code scan, the app generates a new OTP every 30 or 60 seconds, or
sends a push notification with login details so the user can approve or deny a login with one tap.
That OTP or push response serves as the second factor alongside the user's password in your existing
authentication flow.
Yes. FortiToken Mobile can generate time-based OTPs even when the device is
completely offline. An internet connection is only required during initial token activation and when
receiving push notifications. If a user is in an area without connectivity, they can still
authenticate using the OTP displayed in the app.
You need either a FortiGate next-generation firewall running FortiOS 4.3 or later, or
a FortiAuthenticator appliance or virtual machine, to act as the OTP validation server. No external
RADIUS server is required when using FortiGate directly. FortiToken Mobile is also compatible with any
OATH-compliant third-party authentication server.
FortiToken Mobile is available in perpetual license packs for 5, 10, 25, 50, 100,
200, 500, 1,000, 2,000, 5,000, and 10,000 users. Licenses are priced per user and do not require
annual renewal fees, making them a cost-effective long-term investment compared to subscription-based
MFA solutions.
License transfer between devices is not permitted for licenses shipped on or after
August 4, 2025. For licenses purchased before that date, Fortinet's patented cross-platform token
transfer was supported. If you have questions about transfer eligibility for a specific order, contact
a Firewalls.com pre-sales rep and we can help clarify the terms.
Ready to Add Two-Factor Authentication to Your Fortinet Environment?
Our certified pre-sales team can help you choose the right user-count pack, confirm FortiGate or
FortiAuthenticator compatibility, and get your order placed the same day.
