A multi-factor authentication solution that leverages FIDO2, the strongest standards-based authentication method available, via a smartphone app. No physical security key is required. End-to-end cryptography and a sealed MFA challenge/response flow make the authentication process unphishable and confidential.