diff --git a/dashboard/src/components/EnableTwoFADialog.vue b/dashboard/src/components/EnableTwoFADialog.vue
new file mode 100644
index 000000000..014aec780
--- /dev/null
+++ b/dashboard/src/components/EnableTwoFADialog.vue
@@ -0,0 +1,127 @@
+<script setup>
+
+import { ref, useTemplateRef } from 'vue';
+import { Button, ButtonGroup, Dialog, TextInput, InputGroup, FormGroup } from '@cloudron/pankow';
+import { startRegistration } from '@simplewebauthn/browser';
+import ProfileModel from '../models/ProfileModel.js';
+
+const props = defineProps({
+  mandatory2FA: { type: Boolean, default: false },
+  has2FA: { type: Boolean, default: false }
+});
+
+const emit = defineEmits([ 'success' ]);
+
+const profileModel = ProfileModel.create();
+
+const dialog = useTemplateRef('dialog');
+const setupMode = ref('');
+const totpSecret = ref('');
+const totpToken = ref('');
+const totpQRCode = ref('');
+const totpEnableError = ref('');
+const passkeyRegisterError = ref('');
+const passkeyRegisterBusy = ref(false);
+
+async function onTotpEnable() {
+  const [error] = await profileModel.enableTotp(totpToken.value);
+  if (error) {
+    totpToken.value = '';
+    return totpEnableError.value = error.body ? error.body.message : 'Internal error';
+  }
+
+  emit('success');
+  dialog.value.close();
+}
+
+async function onRegisterPasskey() {
+  passkeyRegisterBusy.value = true;
+  passkeyRegisterError.value = '';
+
+  try {
+    const [optionsError, options] = await profileModel.getPasskeyRegistrationOptions();
+    if (optionsError) {
+      passkeyRegisterError.value = optionsError.body?.message || 'Failed to get registration options';
+      passkeyRegisterBusy.value = false;
+      return;
+    }
+
+    const credential = await startRegistration({ optionsJSON: options });
+
+    const [registerError] = await profileModel.registerPasskey(credential, 'Cloudron');
+    if (registerError) {
+      passkeyRegisterError.value = registerError.body?.message || 'Failed to register passkey';
+      passkeyRegisterBusy.value = false;
+      return;
+    }
+
+    emit('success');
+    dialog.value.close();
+  } catch (error) {
+    passkeyRegisterError.value = error.message || 'Passkey registration failed';
+  }
+
+  passkeyRegisterBusy.value = false;
+}
+
+defineExpose({
+  async open() {
+    setupMode.value = 'passkey';
+    totpEnableError.value = '';
+    totpToken.value = '';
+    passkeyRegisterError.value = '';
+
+    dialog.value.open();
+
+    const [error, result] = await profileModel.setTotpSecret();
+    if (error) return console.error(error);
+
+    totpSecret.value = result.secret;
+    totpQRCode.value = result.qrcode;
+  },
+  close() {
+    dialog.value.close();
+  }
+});
+
+</script>
+
+<template>
+  <Dialog ref="dialog" :title="$t('profile.enable2FA.title')" :dismissable="!props.mandatory2FA || props.has2FA">
+    <div style="text-align: center;">
+      <p class="text-warning" v-if="props.mandatory2FA && !props.has2FA">{{ $t('profile.enable2FA.mandatorySetup') }}</p>
+
+      <ButtonGroup>
+        <Button secondary @click="setupMode = 'passkey'" :outline="setupMode !== 'passkey' || null">{{ $t('profile.enable2FA.passkeyOption') }}</Button>
+        <Button secondary @click="setupMode = 'totp'" :outline="setupMode !== 'totp' || null">{{ $t('profile.enable2FA.totpOption') }}</Button>
+      </ButtonGroup>
+
+      <!-- Passkey Setup -->
+      <div v-if="setupMode === 'passkey'" style="text-align: center; margin-top: 20px;">
+        <Button @click="onRegisterPasskey()" :loading="passkeyRegisterBusy" :disabled="passkeyRegisterBusy">{{ $t('profile.enable2FA.registerPasskey') }}</Button>
+        <div class="error-label" v-if="passkeyRegisterError">{{ passkeyRegisterError }}</div>
+      </div>
+
+      <!-- TOTP Setup -->
+      <div v-if="setupMode === 'totp'">
+        <p v-html="$t('profile.enable2FA.authenticatorAppDescription', { googleAuthenticatorPlayStoreLink: 'https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2', googleAuthenticatorITunesLink: 'https://itunes.apple.com/us/app/google-authenticator/id388497605', freeOTPPlayStoreLink: 'https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp', freeOTPITunesLink: 'https://itunes.apple.com/us/app/freeotp-authenticator/id872559395'})"></p>
+        <div style="text-align: center;">
+          <img :src="totpQRCode" style="border-radius: 10px; margin-bottom: 10px"/>
+          <small>{{ totpSecret }}</small>
+        </div>
+        <br/>
+        <form @submit.prevent="onTotpEnable()">
+          <input type="submit" style="display: none;" :disabled="!totpToken"/>
+          <FormGroup style="text-align: left;">
+            <label for="totpTokenInput">{{ $t('profile.enable2FA.token') }}</label>
+            <InputGroup>
+              <TextInput v-model="totpToken" id="totpTokenInput" style="flex-grow: 1;"/>
+              <Button @click="onTotpEnable()" :disabled="!totpToken">{{ $t('profile.enable2FA.enable') }}</Button>
+            </InputGroup>
+            <div class="error-label" v-if="totpEnableError">{{ totpEnableError }}</div>
+          </FormGroup>
+        </form>
+      </div>
+    </div>
+  </Dialog>
+</template>
diff --git a/dashboard/src/models/ProfileModel.js b/dashboard/src/models/ProfileModel.js
index 26d610f53..1a9324b00 100644
--- a/dashboard/src/models/ProfileModel.js
+++ b/dashboard/src/models/ProfileModel.js
@@ -179,10 +179,10 @@ function create() {
 
       return null;
     },
-    async setTwoFASecret() {
+    async setTotpSecret() {
       let error, result;
       try {
-        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/twofactorauthentication_secret`, {}, { access_token: accessToken });
+        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/totp_secret`, {}, { access_token: accessToken });
       } catch (e) {
         error = e;
       }
@@ -190,10 +190,10 @@ function create() {
       if (error || result.status !== 200) return [error || result];
       return [null,  result.body];
     },
-    async enableTwoFA(totpToken) {
+    async enableTotp(totpToken) {
       let error, result;
       try {
-        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/twofactorauthentication_enable`, { totpToken }, { access_token: accessToken });
+        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/totp_enable`, { totpToken }, { access_token: accessToken });
       } catch (e) {
         error = e;
       }
@@ -204,7 +204,7 @@ function create() {
     async disableTwoFA(password) {
       let result;
       try {
-        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/twofactorauthentication_disable`, { password }, { access_token: accessToken });
+        result = await fetcher.post(`${API_ORIGIN}/api/v1/profile/totp_disable`, { password }, { access_token: accessToken });
       } catch (e) {
         return [e];
       }
diff --git a/dashboard/src/models/UsersModel.js b/dashboard/src/models/UsersModel.js
index 0ea68d8d2..3068c70b7 100644
--- a/dashboard/src/models/UsersModel.js
+++ b/dashboard/src/models/UsersModel.js
@@ -202,7 +202,7 @@ function create() {
     async disableTwoFactorAuthentication(id) {
       let result;
       try {
-        result = await fetcher.post(`${API_ORIGIN}/api/v1/users/${id}/twofactorauthentication_disable`, {}, { access_token: accessToken });
+        result = await fetcher.post(`${API_ORIGIN}/api/v1/users/${id}/totp_disable`, {}, { access_token: accessToken });
       } catch (e) {
         return [e];
       }
diff --git a/dashboard/src/views/ProfileView.vue b/dashboard/src/views/ProfileView.vue
index 123d0a5cb..05b905200 100644
--- a/dashboard/src/views/ProfileView.vue
+++ b/dashboard/src/views/ProfileView.vue
@@ -1,8 +1,7 @@
 <script setup>
 
 import { ref, computed, onMounted, useTemplateRef, inject } from 'vue';
-import { Button, ButtonGroup, SingleSelect, Dialog, TextInput, InputGroup, FormGroup } from '@cloudron/pankow';
-import { startRegistration } from '@simplewebauthn/browser';
+import { Button, SingleSelect, FormGroup } from '@cloudron/pankow';
 import { setLanguage } from '../i18n.js';
 import { TOKEN_TYPES } from '../constants.js';
 import AppPasswords from '../components/AppPasswords.vue';
@@ -12,6 +11,7 @@ import PrimaryEmailDialog from '../components/PrimaryEmailDialog.vue';
 import FallbackEmailDialog from '../components/FallbackEmailDialog.vue';
 import PasswordChangeDialog from '../components/PasswordChangeDialog.vue';
 import DisableTwoFADialog from '../components/DisableTwoFADialog.vue';
+import EnableTwoFADialog from '../components/EnableTwoFADialog.vue';
 import Section from '../components/Section.vue';
 import ApiTokens from '../components/ApiTokens.vue';
 import ImagePicker from '../components/ImagePicker.vue';
@@ -101,14 +101,7 @@ async function onRevokeAllWebAndCliTokens() {
 }
 
 const userPasskey = ref(null);
-const twoFASetupMode = ref(''); // 'totp' or 'passkey'
-const twoFASecret = ref('');
-const twoFATotpToken = ref('');
-const twoFAQRCode = ref('');
-const twoFAEnableError = ref('');
-const passkeyRegisterError = ref('');
-const passkeyRegisterBusy = ref(false);
-const twoFADialog = useTemplateRef('twoFADialog');
+const enableTwoFADialog = useTemplateRef('enableTwoFADialog');
 const has2FA = computed(() => profile.value.twoFactorAuthenticationEnabled || !!userPasskey.value);
 
 async function loadPasskey() {
@@ -118,67 +111,15 @@ async function loadPasskey() {
 }
 
 async function onOpenTwoFASetupDialog() {
-  twoFASetupMode.value = 'passkey';
-  twoFAEnableError.value = '';
-  twoFATotpToken.value = '';
-  passkeyRegisterError.value = '';
-
-  twoFADialog.value.open();
-
-  const [error, result] = await profileModel.setTwoFASecret();
-  if (error) return console.error(error);
-
-  twoFASecret.value = result.secret;
-  twoFAQRCode.value = result.qrcode;
+  enableTwoFADialog.value.open();
 }
 
-async function onTwoFAEnable() {
-  const [error] = await profileModel.enableTwoFA(twoFATotpToken.value);
-  if (error) {
-    twoFATotpToken.value = '';
-    return twoFAEnableError.value = error.body ? error.body.message : 'Internal error';
-  }
-
+async function onEnableTwoFASuccess() {
   await refreshProfile();
-  twoFADialog.value.close();
-}
-
-async function onRegisterPasskey() {
-  passkeyRegisterBusy.value = true;
-  passkeyRegisterError.value = '';
-
-  try {
-    // Get registration options from server
-    const [optionsError, options] = await profileModel.getPasskeyRegistrationOptions();
-    if (optionsError) {
-      passkeyRegisterError.value = optionsError.body?.message || 'Failed to get registration options';
-      passkeyRegisterBusy.value = false;
-      return;
-    }
-
-    // Start WebAuthn registration ceremony
-    const credential = await startRegistration({ optionsJSON: options });
-
-    // Send credential to server
-    const [registerError] = await profileModel.registerPasskey(credential, 'Cloudron');
-    if (registerError) {
-      passkeyRegisterError.value = registerError.body?.message || 'Failed to register passkey';
-      passkeyRegisterBusy.value = false;
-      return;
-    }
-
-    await loadPasskey();
-    await refreshProfile();
-    twoFADialog.value.close();
-  } catch (error) {
-    passkeyRegisterError.value = error.message || 'Passkey registration failed';
-  }
-
-  passkeyRegisterBusy.value = false;
+  await loadPasskey();
 }
 
 async function onTwoFADisable() {
-  // Pass the current 2FA method to the disable dialog
   disableTwoFADialog.value.open(userPasskey.value ? 'passkey' : 'totp');
 }
 
@@ -236,45 +177,7 @@ onMounted(async () => {
     <FallbackEmailDialog ref="fallbackEmailDialog" @success="refreshProfile"/>
     <PasswordChangeDialog ref="passwordChangeDialog" @success="refreshProfile"/>
     <DisableTwoFADialog ref="disableTwoFADialog" @success="onTwoFADisableSuccess"/>
-
-    <!-- 2FA setup Dialog -->
-    <Dialog ref="twoFADialog" :title="$t('profile.enable2FA.title')" :dismissable="!config.mandatory2FA || has2FA">
-      <div style="text-align: center;">
-        <p class="text-warning" v-if="config.mandatory2FA && !has2FA">{{ $t('profile.enable2FA.mandatorySetup') }}</p>
-
-        <ButtonGroup>
-          <Button secondary @click="twoFASetupMode = 'passkey'" :outline="twoFASetupMode !== 'passkey' || null">{{ $t('profile.enable2FA.passkeyOption') }}</Button>
-          <Button secondary @click="twoFASetupMode = 'totp'" :outline="twoFASetupMode !== 'totp' || null">{{ $t('profile.enable2FA.totpOption') }}</Button>
-        </ButtonGroup>
-
-        <!-- Passkey Setup -->
-        <div v-if="twoFASetupMode === 'passkey'" style="text-align: center; margin-top: 20px;">
-          <Button @click="onRegisterPasskey()" :loading="passkeyRegisterBusy" :disabled="passkeyRegisterBusy">{{ $t('profile.enable2FA.registerPasskey') }}</Button>
-          <div class="error-label" v-if="passkeyRegisterError">{{ passkeyRegisterError }}</div>
-        </div>
-
-        <!-- TOTP Setup -->
-        <div v-if="twoFASetupMode === 'totp'">
-          <p v-html="$t('profile.enable2FA.authenticatorAppDescription', { googleAuthenticatorPlayStoreLink: 'https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2', googleAuthenticatorITunesLink: 'https://itunes.apple.com/us/app/google-authenticator/id388497605', freeOTPPlayStoreLink: 'https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp', freeOTPITunesLink: 'https://itunes.apple.com/us/app/freeotp-authenticator/id872559395'})"></p>
-          <div style="text-align: center;">
-            <img :src="twoFAQRCode" style="border-radius: 10px; margin-bottom: 10px"/>
-            <small>{{ twoFASecret }}</small>
-          </div>
-          <br/>
-          <form @submit.prevent="onTwoFAEnable()">
-            <input type="submit" style="display: none;" :disabled="!twoFATotpToken"/>
-            <FormGroup style="text-align: left;">
-              <label for="totpTokenInput">{{ $t('profile.enable2FA.token') }}</label>
-              <InputGroup>
-                <TextInput v-model="twoFATotpToken" id="totpTokenInput" style="flex-grow: 1;"/>
-                <Button @click="onTwoFAEnable()" :disabled="!twoFATotpToken">{{ $t('profile.enable2FA.enable') }}</Button>
-              </InputGroup>
-              <div class="error-label" v-if="twoFAEnableError">{{ twoFAEnableError }}</div>
-            </FormGroup>
-          </form>
-        </div>
-      </div>
-    </Dialog>
+    <EnableTwoFADialog ref="enableTwoFADialog" :mandatory2FA="config.mandatory2FA" :has2FA="has2FA" @success="onEnableTwoFASuccess"/>
 
     <Section :title="$t('profile.title')">
       <div style="display: flex; flex-wrap: wrap; gap: 20px">
diff --git a/src/routes/test/profile-test.js b/src/routes/test/profile-test.js
index 01e5005e6..03d91761d 100644
--- a/src/routes/test/profile-test.js
+++ b/src/routes/test/profile-test.js
@@ -241,7 +241,7 @@ describe('Profile API', function () {
         let secret;
 
         it('can get secret', async function () {
-            const response = await superagent.post(`${serverUrl}/api/v1/profile/twofactorauthentication_secret`)
+            const response = await superagent.post(`${serverUrl}/api/v1/profile/totp_secret`)
                 .query({ access_token: user.token })
                 .send({});
 
@@ -251,7 +251,7 @@ describe('Profile API', function () {
         it('can enable 2fa', async function () {
             const totpToken = speakeasy.totp({ secret, encoding: 'base32' });
 
-            await superagent.post(`${serverUrl}/api/v1/profile/twofactorauthentication_enable`)
+            await superagent.post(`${serverUrl}/api/v1/profile/totp_enable`)
                 .query({ access_token: user.token })
                 .send({ totpToken });
         });
@@ -287,7 +287,7 @@ describe('Profile API', function () {
         });
 
         it('can disable 2fa', async function () {
-            await superagent.post(`${serverUrl}/api/v1/profile/twofactorauthentication_disable`)
+            await superagent.post(`${serverUrl}/api/v1/profile/totp_disable`)
                 .query({ access_token: user.token })
                 .send({ password: user.password });
         });
diff --git a/src/server.js b/src/server.js
index 8cf1a697b..9dd4372c2 100644
--- a/src/server.js
+++ b/src/server.js
@@ -195,9 +195,9 @@ async function initializeExpressSync() {
     router.post('/api/v1/profile/background_image',                      token, authorizeUser, multipart, routes.profile.setBackgroundImage); // backgroundImage is not exposed in LDAP. so it's personal and not locked
     router.del ('/api/v1/profile/background_image',                      token, authorizeUser,            routes.profile.unsetBackgroundImage); // backgroundImage is not exposed in LDAP. so it's personal and not locked
     router.post('/api/v1/profile/password',                        json, token, authorizeUser, routes.users.verifyPassword, routes.profile.setPassword);
-    router.post('/api/v1/profile/twofactorauthentication_secret',  json, token, authorizeUser, routes.profile.setTwoFactorAuthenticationSecret);
-    router.post('/api/v1/profile/twofactorauthentication_enable',  json, token, authorizeUser, routes.profile.enableTwoFactorAuthentication);
-    router.post('/api/v1/profile/twofactorauthentication_disable', json, token, authorizeUser, routes.users.verifyPassword, routes.profile.disableTwoFactorAuthentication);
+    router.post('/api/v1/profile/totp_secret',  json, token, authorizeUser, routes.profile.setTwoFactorAuthenticationSecret);
+    router.post('/api/v1/profile/totp_enable',  json, token, authorizeUser, routes.profile.enableTwoFactorAuthentication);
+    router.post('/api/v1/profile/totp_disable', json, token, authorizeUser, routes.users.verifyPassword, routes.profile.disableTwoFactorAuthentication);
     router.post('/api/v1/profile/notification_config',             json, token, authorizeUser, routes.profile.setNotificationConfig); // non-admins cannot get notifications anyway
     router.del ('/api/v1/profile/sessions',                              token, authorizeUser, routes.profile.destroyUserSession);
 
@@ -237,7 +237,7 @@ async function initializeExpressSync() {
     router.post('/api/v1/users/:userId/send_password_reset_email', json, token, authorizeUserManager, routes.users.load, routes.users.sendPasswordResetEmail);
     router.get ('/api/v1/users/:userId/invite_link',                     token, authorizeUserManager, routes.users.load, routes.users.getInviteLink);
     router.post('/api/v1/users/:userId/send_invite_email',         json, token, authorizeUserManager, routes.users.load, routes.users.sendInviteEmail);
-    router.post('/api/v1/users/:userId/twofactorauthentication_disable', json, token, authorizeUserManager, routes.users.load, routes.users.disableTwoFactorAuthentication);
+    router.post('/api/v1/users/:userId/totp_disable', json, token, authorizeUserManager, routes.users.load, routes.users.disableTwoFactorAuthentication);
 
     // Group management
     router.get ('/api/v1/groups',                        token, authorizeUserManager, routes.groups.list);