Offline access and recovery codes

A login-MFA product must answer one question honestly: what if the machine has no internet? Dynacop’s answer is local verification, plus recovery codes for real emergencies.

Offline verification

With Offline access enabled (the default), the agent can verify a person’s TOTP code locally — without reaching the Dynacop cloud. The person signs in normally with their usual authenticator code; the check happens on the machine.

The person must have signed in online at least once on that machine beforehand (that’s when the local data is provisioned).

One-time recovery codes

For emergencies — no network and no phone — Dynacop supports one-time recovery codes:

• Generated on the machine itself with the agent command (dynacop-agent bypass-gen, up to 50 codes), shown once, and meant to be stored somewhere safe (a sealed envelope, a password manager).
• Each code works exactly once, and validation is fully local: they work even with the backend completely unreachable.
• Stored on the machine only as SHA-256 hashes inside a DPAPI-protected store — the plaintext codes exist nowhere after generation.

Treat them like break-glass material: generate them when you enable enforcement, store them offline, and regenerate after use.

How this interacts with fail-mode

Fail-mode only matters when no verification path is available. With offline access on and people provisioned, a network outage doesn’t degrade security to fail-open — codes still verify locally. Recovery codes are the final layer beneath that.

Situation	What verifies the sign-in
Online	Cloud verification
Offline, person known on machine	Local TOTP verification
Offline, no authenticator available	One-time recovery code
Nothing available	Fail-mode decides (open/closed)