Abstract: Various features pertain to two-factor authentication. A user seeking access to the secure facility or system generates a time-limited Quick Response (QR) code with his or her smartphone for display on a touchpad screen of the smartphone. The user presents the display of the QR code to a video camera of an authentication system that controls access to the secure facility or system. The video camera captures both the QR code on the smartphone screen and an image of the user. The authentication system then identifies the user based on a biometric analysis of the image of the user and confirms the authentication by verifying that the QR code corresponds to an authorized user. The QR code may be generated based on a secret key stored within the smartphone and the current date/time, with valid authorization limited to a narrow time window following generation of the QR code.