diff --git a/src/Nager.Authentication.Abstraction/Models/AuthenticationResult.cs b/src/Nager.Authentication.Abstraction/Models/AuthenticationResult.cs
new file mode 100644
index 0000000..16c999f
--- /dev/null
+++ b/src/Nager.Authentication.Abstraction/Models/AuthenticationResult.cs
@@ -0,0 +1,8 @@
+namespace Nager.Authentication.Abstraction.Models
+{
+    public class AuthenticationResult
+    {
+        public AuthenticationStatus Status { get; set; }
+        public string MfaIdentifier { get; set; }
+    }
+}
diff --git a/src/Nager.Authentication.Abstraction/Models/MfaActivationResult.cs b/src/Nager.Authentication.Abstraction/Models/MfaActivationResult.cs
new file mode 100644
index 0000000..1994b8a
--- /dev/null
+++ b/src/Nager.Authentication.Abstraction/Models/MfaActivationResult.cs
@@ -0,0 +1,33 @@
+namespace Nager.Authentication.Abstraction.Models
+{
+    /// <summary>
+    /// Mfa Activation Result
+    /// </summary>
+    public enum MfaActivationResult
+    {
+        /// <summary>
+        /// MFA activation was successful
+        /// </summary>
+        Success,
+
+        /// <summary>
+        /// MFA activation failed
+        /// </summary>
+        Failed,
+
+        /// <summary>
+        /// MFA is already activated
+        /// </summary>
+        AlreadyActive,
+
+        /// <summary>
+        /// The provided authentication code is invalid
+        /// </summary>
+        InvalidCode,
+
+        /// <summary>
+        /// The user could not be found
+        /// </summary>
+        UserNotFound
+    }
+}
diff --git a/src/Nager.Authentication.Abstraction/Models/MfaDeactivationResult.cs b/src/Nager.Authentication.Abstraction/Models/MfaDeactivationResult.cs
new file mode 100644
index 0000000..a45923f
--- /dev/null
+++ b/src/Nager.Authentication.Abstraction/Models/MfaDeactivationResult.cs
@@ -0,0 +1,33 @@
+namespace Nager.Authentication.Abstraction.Models
+{
+    /// <summary>
+    /// Mfa Deactivation Result
+    /// </summary>
+    public enum MfaDeactivationResult
+    {
+        /// <summary>
+        /// MFA activation was successful
+        /// </summary>
+        Success,
+
+        /// <summary>
+        /// MFA activation failed
+        /// </summary>
+        Failed,
+
+        /// <summary>
+        /// MFA was not active
+        /// </summary>
+        NotActive,
+
+        /// <summary>
+        /// The provided authentication code is invalid
+        /// </summary>
+        InvalidCode,
+
+        /// <summary>
+        /// The user could not be found
+        /// </summary>
+        UserNotFound
+    }
+}
diff --git a/src/Nager.Authentication.Abstraction/Models/MfaInformation.cs b/src/Nager.Authentication.Abstraction/Models/MfaInformation.cs
new file mode 100644
index 0000000..13868d7
--- /dev/null
+++ b/src/Nager.Authentication.Abstraction/Models/MfaInformation.cs
@@ -0,0 +1,8 @@
+namespace Nager.Authentication.Abstraction.Models
+{
+    public class MfaInformation
+    {
+        public bool IsActive { get; set; }
+        public string ActivationQrCode { get; set; }
+    }
+}
diff --git a/src/Nager.Authentication.Abstraction/Models/ValidateTokenResult.cs b/src/Nager.Authentication.Abstraction/Models/ValidateTokenResult.cs
new file mode 100644
index 0000000..e9b96ab
--- /dev/null
+++ b/src/Nager.Authentication.Abstraction/Models/ValidateTokenResult.cs
@@ -0,0 +1,8 @@
+namespace Nager.Authentication.Abstraction.Models
+{
+    public class ValidateTokenResult
+    {
+        public bool Success { get; set; }
+        public string EmailAddress { get; set; }
+    }
+}
diff --git a/src/Nager.Authentication.Abstraction/Services/IUserAccountService.cs b/src/Nager.Authentication.Abstraction/Services/IUserAccountService.cs
index 6ea4c5d..5430469 100644
--- a/src/Nager.Authentication.Abstraction/Services/IUserAccountService.cs
+++ b/src/Nager.Authentication.Abstraction/Services/IUserAccountService.cs
@@ -22,12 +22,12 @@ Task<bool> ChangePasswordAsync(
             CancellationToken cancellationToken = default);
 
         /// <summary>
-        /// Get Mfa activation qr code
+        /// Get Mfa Information
         /// </summary>
         /// <param name="emailAddress"></param>
         /// <param name="cancellationToken"></param>
         /// <returns></returns>
-        Task<string> GetMfaActivationQrCodeAsync(
+        Task<MfaInformation> GetMfaInformationAsync(
             string emailAddress,
             CancellationToken cancellationToken = default);
 
@@ -38,7 +38,19 @@ Task<string> GetMfaActivationQrCodeAsync(
         /// <param name="token"></param>
         /// <param name="cancellationToken"></param>
         /// <returns></returns>
-        Task<bool> ActivateMfaAsync(
+        Task<MfaActivationResult> ActivateMfaAsync(
+            string emailAddress,
+            string token,
+            CancellationToken cancellationToken = default);
+
+        /// <summary>
+        /// Deactivate Mfa
+        /// </summary>
+        /// <param name="emailAddress"></param>
+        /// <param name="token"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        Task<MfaDeactivationResult> DeactivateMfaAsync(
             string emailAddress,
             string token,
             CancellationToken cancellationToken = default);
diff --git a/src/Nager.Authentication.Abstraction/Services/IUserAuthenticationService.cs b/src/Nager.Authentication.Abstraction/Services/IUserAuthenticationService.cs
index 9c4fce3..f144059 100644
--- a/src/Nager.Authentication.Abstraction/Services/IUserAuthenticationService.cs
+++ b/src/Nager.Authentication.Abstraction/Services/IUserAuthenticationService.cs
@@ -15,12 +15,12 @@ public interface IUserAuthenticationService
         /// <param name="authenticationRequest"></param>
         /// <param name="cancellationToken"></param>
         /// <returns></returns>
-        Task<AuthenticationStatus> ValidateCredentialsAsync(
+        Task<AuthenticationResult> ValidateCredentialsAsync(
             AuthenticationRequest authenticationRequest,
             CancellationToken cancellationToken = default);
 
-        Task<bool> ValidateTokenAsync(
-            string emailAddress,
+        Task<ValidateTokenResult> ValidateTokenAsync(
+            string mfaIdentifier,
             string token,
             CancellationToken cancellationToken = default);
 
diff --git a/src/Nager.Authentication.AspNet/Controllers/AuthenticationController.cs b/src/Nager.Authentication.AspNet/Controllers/AuthenticationController.cs
index a3cfb15..2eb536b 100644
--- a/src/Nager.Authentication.AspNet/Controllers/AuthenticationController.cs
+++ b/src/Nager.Authentication.AspNet/Controllers/AuthenticationController.cs
@@ -109,43 +109,6 @@ private async Task<JwtSecurityToken> CreateTokenAsync(
                 signingCredentials: credentials);
         }
 
-        private JwtSecurityToken CreateTotpCheckToken(
-            AuthenticationRequestDto request)
-        {
-            var issuer = this._configuration["Authentication:Tokens:Issuer"];
-            var audience = this._configuration["Authentication:Tokens:Audience"];
-            var signingKey = this._configuration["Authentication:Tokens:SigningKey"];
-
-            var expiresAt = DateTime.UtcNow.AddMinutes(5);
-
-            if (string.IsNullOrEmpty(issuer))
-            {
-                throw new MissingConfigurationException($"{nameof(issuer)} is missing");
-            }
-
-            if (string.IsNullOrEmpty(signingKey))
-            {
-                throw new MissingConfigurationException($"{nameof(signingKey)} is missing");
-            }
-
-            var temporaryIdentity = $"totp:{request.EmailAddress}";
-
-            var claims = new List<Claim>
-            {
-                new(JwtRegisteredClaimNames.UniqueName, temporaryIdentity),
-                new(JwtRegisteredClaimNames.Email, temporaryIdentity)
-            };
-
-            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey));
-            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);
-
-            return new JwtSecurityToken(issuer,
-                audience,
-                claims,
-                expires: expiresAt,
-                signingCredentials: credentials);
-        }
-
         /// <summary>
         /// Authenticate via Email and Password
         /// </summary>
@@ -153,6 +116,7 @@ private JwtSecurityToken CreateTotpCheckToken(
         /// <param name="cancellationToken"></param>
         /// <returns></returns>
         /// <response code="200">Authentication successful</response>
+        /// <response code="401">Mfa required</response>
         /// <response code="406">Invalid credential</response>
         /// <response code="429">Credential check temporarily locked</response>
         /// <response code="500">Unexpected error</response>
@@ -160,6 +124,7 @@ private JwtSecurityToken CreateTotpCheckToken(
         [HttpPost]
         [Route("")]
         [ProducesResponseType(StatusCodes.Status200OK)]
+        [ProducesResponseType(StatusCodes.Status401Unauthorized)]
         [ProducesResponseType(StatusCodes.Status406NotAcceptable)]
         [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
@@ -177,12 +142,12 @@ public async Task<ActionResult<AuthenticationResponseDto>> AuthenticateAsync(
                 IpAddress = ipAddress
             };
 
-            var authenticationStatus = await this._userAuthenticationService.ValidateCredentialsAsync(authenticationRequest, cancellationToken);
-            this._logger.LogInformation($"{nameof(AuthenticateAsync)} - EmailAddress:{request.EmailAddress}, AuthenticationStatus:{authenticationStatus}");
+            var authenticationResult = await this._userAuthenticationService.ValidateCredentialsAsync(authenticationRequest, cancellationToken);
+            this._logger.LogInformation($"{nameof(AuthenticateAsync)} - EmailAddress:{request.EmailAddress}, AuthenticationStatus:{authenticationResult}");
 
             var tokenHandler = new JwtSecurityTokenHandler();
 
-            switch (authenticationStatus)
+            switch (authenticationResult.Status)
             {
                 case AuthenticationStatus.Invalid:
                     return StatusCode(StatusCodes.Status406NotAcceptable);
@@ -204,13 +169,10 @@ public async Task<ActionResult<AuthenticationResponseDto>> AuthenticateAsync(
                         return StatusCode(StatusCodes.Status500InternalServerError);
                     }
                 case AuthenticationStatus.MfaCodeRequired:
-                    var jwtTotpCheckToken = CreateTotpCheckToken(request);
-                    var totpToken = tokenHandler.WriteToken(jwtTotpCheckToken);
-
-                    return StatusCode(StatusCodes.Status200OK, new AuthenticationResponseDto
+                    return StatusCode(StatusCodes.Status401Unauthorized, new MfaRequiredResponseDto
                     {
-                        Token = totpToken,
-                        Expiration = jwtTotpCheckToken.ValidTo
+                        MfaType = "TOTP",
+                        MfaIdentifier = authenticationResult.MfaIdentifier
                     });
                 case AuthenticationStatus.TemporaryBlocked:
                     return StatusCode(StatusCodes.Status429TooManyRequests);
@@ -225,32 +187,26 @@ public async Task<ActionResult<AuthenticationResponseDto>> AuthenticateAsync(
         /// <param name="request"></param>
         /// <param name="cancellationToken"></param>
         /// <returns></returns>
-        ///// <response code="200">Authentication successful</response>
-        ///// <response code="406">Invalid credential</response>
-        ///// <response code="429">Credential check temporarily locked</response>
-        ///// <response code="500">Unexpected error</response>
+        /// <response code="200">Authentication successful</response>
+        /// <response code="406">Invalid credential</response>
+        /// <response code="500">Unexpected error</response>
+        [AllowAnonymous]
         [HttpPost]
         [Route("Token")]
         [ProducesResponseType(StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status406NotAcceptable)]
-        [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
+        [ProducesResponseType(StatusCodes.Status400BadRequest)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
         public async Task<ActionResult<AuthenticationResponseDto>> SecondStepTotpAsync(
-            [Required][FromBody] TimeBasedOneTimeTokenRequestDto request,
+            [Required][FromBody] AuthenticationMfaTokenRequestDto request,
             CancellationToken cancellationToken = default)
         {
-
-            var emailAddress = HttpContext.User.Identity?.Name;
-
-            var validEmailAddress = emailAddress.Substring(5);
-
-            var isTokenValid = await this._userAuthenticationService.ValidateTokenAsync(validEmailAddress, request.Token, cancellationToken);
-            if (!isTokenValid)
+            var validateTokenResult = await this._userAuthenticationService.ValidateTokenAsync(request.MfaIdentifier, request.Token, cancellationToken);
+            if (!validateTokenResult.Success)
             {
                 return StatusCode(StatusCodes.Status400BadRequest);
             }
 
-            var jwtSecurityToken = await this.CreateTokenAsync(validEmailAddress);
+            var jwtSecurityToken = await this.CreateTokenAsync(validateTokenResult.EmailAddress);
 
             var tokenHandler = new JwtSecurityTokenHandler();
             var token = tokenHandler.WriteToken(jwtSecurityToken);
diff --git a/src/Nager.Authentication.AspNet/Controllers/UserAccountController.cs b/src/Nager.Authentication.AspNet/Controllers/UserAccountController.cs
index 3ac91ab..f889ac1 100644
--- a/src/Nager.Authentication.AspNet/Controllers/UserAccountController.cs
+++ b/src/Nager.Authentication.AspNet/Controllers/UserAccountController.cs
@@ -79,7 +79,7 @@ public async Task<ActionResult> ChangePasswordAsync(
         /// <response code="204">Password changed</response>
         /// <response code="500">Unexpected error</response>
         [HttpGet]
-        [Route("MfaActivationInfo")]
+        [Route("Mfa")]
         [ProducesResponseType(StatusCodes.Status204NoContent)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
         public async Task<ActionResult> GetMfaActivationAsync(
@@ -91,13 +91,17 @@ public async Task<ActionResult> GetMfaActivationAsync(
                 return StatusCode(StatusCodes.Status500InternalServerError);
             }
 
-            var image = await this._userAccountService.GetMfaActivationQrCodeAsync(emailAddress, cancellationToken);
+            var information = await this._userAccountService.GetMfaInformationAsync(emailAddress, cancellationToken);
+            if (information == null)
+            {
+                return StatusCode(StatusCodes.Status500InternalServerError);
+            }
 
-            return StatusCode(StatusCodes.Status200OK, new { image = image});
+            return StatusCode(StatusCodes.Status200OK, information);
         }
 
         /// <summary>
-        /// Activate mfa
+        /// Activate Mfa
         /// </summary>
         /// <param name="request"></param>
         /// <param name="cancellationToken"></param>
@@ -105,7 +109,7 @@ public async Task<ActionResult> GetMfaActivationAsync(
         /// <response code="204">Password changed</response>
         /// <response code="500">Unexpected error</response>
         [HttpPost]
-        [Route("MfaActivate")]
+        [Route("Mfa/Activate")]
         [ProducesResponseType(StatusCodes.Status204NoContent)]
         [ProducesResponseType(StatusCodes.Status500InternalServerError)]
         public async Task<ActionResult> ActivateMfaAsync(
@@ -118,12 +122,66 @@ public async Task<ActionResult> ActivateMfaAsync(
                 return StatusCode(StatusCodes.Status500InternalServerError);
             }
 
-            if (await this._userAccountService.ActivateMfaAsync(emailAddress, request.Token, cancellationToken))
+            var mfaResult = await this._userAccountService.ActivateMfaAsync(emailAddress, request.Token, cancellationToken);
+
+            switch (mfaResult)
             {
-                return StatusCode(StatusCodes.Status204NoContent);
+                case MfaActivationResult.Success:
+                    return StatusCode(StatusCodes.Status204NoContent);
+
+                case MfaActivationResult.UserNotFound:
+                case MfaActivationResult.Failed:
+                    return StatusCode(StatusCodes.Status500InternalServerError);
+
+                case MfaActivationResult.AlreadyActive:
+                case MfaActivationResult.InvalidCode:
+                    return StatusCode(StatusCodes.Status400BadRequest, new { error = mfaResult.ToString() });
+
+                default:
+                    return StatusCode(StatusCodes.Status500InternalServerError);
+            }           
+        }
+
+        /// <summary>
+        /// Deactivate Mfa
+        /// </summary>
+        /// <param name="request"></param>
+        /// <param name="cancellationToken"></param>
+        /// <returns></returns>
+        /// <response code="204">Password changed</response>
+        /// <response code="500">Unexpected error</response>
+        [HttpPost]
+        [Route("Mfa/Deactivate")]
+        [ProducesResponseType(StatusCodes.Status204NoContent)]
+        [ProducesResponseType(StatusCodes.Status500InternalServerError)]
+        public async Task<ActionResult> DeactivateMfaAsync(
+            [Required][FromBody] TimeBasedOneTimeTokenRequestDto request,
+            CancellationToken cancellationToken = default)
+        {
+            var emailAddress = HttpContext.User.Identity?.Name;
+            if (string.IsNullOrEmpty(emailAddress))
+            {
+                return StatusCode(StatusCodes.Status500InternalServerError);
             }
 
-            return StatusCode(StatusCodes.Status500InternalServerError);
+            var mfaResult = await this._userAccountService.DeactivateMfaAsync(emailAddress, request.Token, cancellationToken);
+
+            switch (mfaResult)
+            {
+                case MfaDeactivationResult.Success:
+                    return StatusCode(StatusCodes.Status204NoContent);
+
+                case MfaDeactivationResult.UserNotFound:
+                case MfaDeactivationResult.Failed:
+                    return StatusCode(StatusCodes.Status500InternalServerError);
+
+                case MfaDeactivationResult.NotActive:
+                case MfaDeactivationResult.InvalidCode:
+                    return StatusCode(StatusCodes.Status400BadRequest, new { error = mfaResult.ToString() });
+
+                default:
+                    return StatusCode(StatusCodes.Status500InternalServerError);
+            }
         }
     }
 }
diff --git a/src/Nager.Authentication.AspNet/Dtos/AuthenticationMfaTokenRequestDto.cs b/src/Nager.Authentication.AspNet/Dtos/AuthenticationMfaTokenRequestDto.cs
new file mode 100644
index 0000000..62b48d3
--- /dev/null
+++ b/src/Nager.Authentication.AspNet/Dtos/AuthenticationMfaTokenRequestDto.cs
@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Nager.Authentication.AspNet.Dtos
+{
+    public class AuthenticationMfaTokenRequestDto
+    {
+        [Required]
+        public string MfaIdentifier { get; set; }
+
+        [Required]
+        public string Token { get; set; }
+    }
+}
diff --git a/src/Nager.Authentication.AspNet/Dtos/MfaRequiredResponseDto.cs b/src/Nager.Authentication.AspNet/Dtos/MfaRequiredResponseDto.cs
new file mode 100644
index 0000000..e3cf890
--- /dev/null
+++ b/src/Nager.Authentication.AspNet/Dtos/MfaRequiredResponseDto.cs
@@ -0,0 +1,8 @@
+namespace Nager.Authentication.AspNet.Dtos
+{
+    public class MfaRequiredResponseDto
+    {
+        public string MfaIdentifier { get; set; }
+        public string MfaType { get; set; }
+    }
+}
diff --git a/src/Nager.Authentication.TestProject.WebApp/wwwroot/account.html b/src/Nager.Authentication.TestProject.WebApp/wwwroot/account.html
index a099365..326584f 100644
--- a/src/Nager.Authentication.TestProject.WebApp/wwwroot/account.html
+++ b/src/Nager.Authentication.TestProject.WebApp/wwwroot/account.html
@@ -15,31 +15,37 @@
 
     <div v-cloak id="app" style="padding-left:10px; padding-right:10px;">
 
-        <div v-if="token">
-            <form action="javascript:void(0);">
+        <div v-if="authenticationToken">
+            <form @submit.prevent="changePassword()">
                 <fieldset>
                     <legend>Change password</legend>
 
                     <label>Password</label>
                     <input type="password" v-model="password" /><br />
-                    <button @click="changePassword()">Change</button>
+                    <button type="submit">Change</button>
                 </fieldset>
             </form>
 
             <form action="javascript:void(0);">
                 <fieldset>
-                    <legend>Activate MFA</legend>
+                    <legend>MFA</legend>
+
+                    <label>Active</label>
+                    {{ mfaInformation.isActive }}<br />
+
+                    <label>Activation Code</label>
+                    <img v-if="!mfaInformation.isActive" :src="mfaInformation.activationQrCode" /><br />
+                    <br />
 
                     <label>Token</label>
-                    <input type="text" v-model="activationToken" /><br />
-                    <button @click="activateMfa()">Activate</button>
+                    <input type="text" v-model="totpCode" /><br />
+                    <button v-if="!mfaInformation.isActive" @click="activateMfa()">Activate</button>
+                    <button v-if="mfaInformation.isActive" @click="deactivateMfa()">Deactivate</button>
                 </fieldset>
             </form>
 
         </div>
 
-        <img :src="test.image" />
-
         <hr />
 
         <div v-if="responseStatusCode" style="margin-bottom:10px;">
@@ -74,8 +80,8 @@
         createApp({
             data() {
                 return {
-                    test: '',
-                    activationToken: '',
+                    mfaInformation: '',
+                    totpCode: '',
                     password: '',
                     responseData: undefined,
                     responseError: undefined,
@@ -83,17 +89,11 @@
                 }
             },
             async created() {
-                const response = await fetch('/api/v1/UserAccount/MfaActivationInfo', {
-                    headers: {
-                        "Authorization": `Bearer ${this.token}`,
-                        "Content-Type": 'application/json'
-                    }
-                })
-                this.test = await response.json();
+                this.getMfaInformation()
             },
             computed: {
-                token() {
-                    return localStorage.getItem(tokenKey);
+                authenticationToken() {
+                    return localStorage.getItem(tokenKey)
                 }
             },
             methods: {
@@ -102,11 +102,20 @@
                     this.responseData = undefined
                     this.responseError = undefined
                 },
+                async getMfaInformation() {
+                    const response = await fetch('/api/v1/UserAccount/Mfa', {
+                        headers: {
+                            "Authorization": `Bearer ${this.authenticationToken}`,
+                            "Content-Type": 'application/json'
+                        }
+                    })
+                    this.mfaInformation = await response.json()
+                },
                 async changePassword() {
                     const response = await fetch('/api/v1/UserAccount/ChangePassword', {
                         method: "POST",
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         },
                         body: JSON.stringify({
@@ -117,18 +126,40 @@
                     this.responseStatusCode = response.status
                 },
                 async activateMfa() {
-                    const response = await fetch('/api/v1/UserAccount/MfaActivate', {
+                    const response = await fetch('/api/v1/UserAccount/Mfa/Activate', {
                         method: "POST",
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         },
                         body: JSON.stringify({
-                            token: this.activationToken
+                            token: this.totpCode
                         })
                     })
 
                     this.responseStatusCode = response.status
+
+                    if (response.status === 204) {
+                        await this.getMfaInformation()
+                    }
+                },
+                async deactivateMfa() {
+                    const response = await fetch('/api/v1/UserAccount/Mfa/Deactivate', {
+                        method: "POST",
+                        headers: {
+                            "Authorization": `Bearer ${this.authenticationToken}`,
+                            "Content-Type": 'application/json'
+                        },
+                        body: JSON.stringify({
+                            token: this.totpCode
+                        })
+                    })
+
+                    this.responseStatusCode = response.status
+
+                    if (response.status === 204) {
+                        await this.getMfaInformation()
+                    }
                 }
             }
         }).mount('#app')
diff --git a/src/Nager.Authentication.TestProject.WebApp/wwwroot/index.html b/src/Nager.Authentication.TestProject.WebApp/wwwroot/index.html
index 9913caf..b11b919 100644
--- a/src/Nager.Authentication.TestProject.WebApp/wwwroot/index.html
+++ b/src/Nager.Authentication.TestProject.WebApp/wwwroot/index.html
@@ -15,32 +15,39 @@
 
     <div v-cloak id="app" style="padding-left:10px; padding-right:10px;">
 
-        <div v-if="token">
+        <div v-if="authenticationToken">
             <button @click="logout">Logout</button>
 
             <div style="margin-top:30px; background-color:#d6fdd7;">
                 <div style="padding:10px;">
                     <strong>Token Content</strong><br />
                     <pre>{{ tokenInfo }}</pre>
-
-                    <input type="text" v-model="mfaToken" />
-                    <button @click="sendToken()">Send Token</button>
                 </div>
             </div>
         </div>
         <div v-else>
-            <div>
-                <strong>EmailAddress</strong><br />
-                <input type="text" v-model="emailAddress" />
-            </div>
-            <div style="margin-top:6px;">
-                <strong>Password</strong><br />
-                <input type="password" v-model="password" />
-            </div>
+            <form @submit.prevent="login()">
+                <div>
+                    <strong>EmailAddress</strong><br />
+                    <input type="text" v-model="emailAddress" />
+                </div>
+                <div style="margin-top:6px;">
+                    <strong>Password</strong><br />
+                    <input type="password" v-model="password" />
+                </div>
 
-            <div style="margin-top:12px;">
-                <button @click="login()">Login</button>
-            </div>
+                <div style="margin-top:12px;">
+                    <button type="submit">Login</button>
+                </div>
+            </form>
+        </div>
+
+        <div v-if="showMfaTokenBox">
+            <h2>MFA - Second step required</h2>
+            <form @submit.prevent="sendToken()">
+                <input type="text" v-model="mfaToken" />
+                <button type="submit">Send Token</button>
+            </form>
         </div>
 
         <hr />
@@ -78,8 +85,10 @@
         createApp({
             data() {
                 return {
-                    token: undefined,
+                    authenticationToken: undefined,
                     mfaToken: undefined,
+                    mfaIdentifier: undefined,
+                    showMfaTokenBox: false,
                     emailAddress: '',
                     password: '',
                     responseData: undefined,
@@ -88,11 +97,11 @@
                 }
             },
             created() {
-                this.token = localStorage.getItem(tokenKey)
+                this.authenticationToken = localStorage.getItem(tokenKey)
             },
             computed: {
                 tokenInfo() {
-                    const parts = this.token.split('.')
+                    const parts = this.authenticationToken.split('.')
 
                     if (parts.length !== 3) {
                         return
@@ -109,7 +118,7 @@
                 },
                 logout() {
                     localStorage.removeItem(tokenKey)
-                    this.token = undefined
+                    this.authenticationToken = undefined
 
                     this.clearLastRequest()
                 },
@@ -129,20 +138,24 @@
                         const token = this.responseData.token
 
                         localStorage.setItem(tokenKey, token)
-                        this.token = token
+                        this.authenticationToken = token
 
                     } else if (response.status === 400) {
                         this.responseError = await response.json()
+                    } else if (response.status === 401) {
+                        const mfa = await response.json()
+                        this.mfaIdentifier = mfa.mfaIdentifier
+                        this.showMfaTokenBox = true
                     }
                 },
                 async sendToken() {
                     const response = await fetch('/api/v1/Authentication/Token', {
                         method: "POST",
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
                             "Content-Type": 'application/json'
                         },
                         body: JSON.stringify({
+                            mfaIdentifier: this.mfaIdentifier,
                             token: this.mfaToken
                         })
                     })
@@ -155,7 +168,7 @@
                         const token = this.responseData.token
 
                         localStorage.setItem(tokenKey, token)
-                        this.token = token
+                        this.authenticationToken = token
 
                     } else if (response.status === 400) {
                         this.responseError = await response.json()
diff --git a/src/Nager.Authentication.TestProject.WebApp/wwwroot/management.html b/src/Nager.Authentication.TestProject.WebApp/wwwroot/management.html
index a945c29..4c2269c 100644
--- a/src/Nager.Authentication.TestProject.WebApp/wwwroot/management.html
+++ b/src/Nager.Authentication.TestProject.WebApp/wwwroot/management.html
@@ -94,7 +94,7 @@
                 }
             },
             computed: {
-                token() {
+                authenticationToken() {
                     return localStorage.getItem(tokenKey)
                 }
             },
@@ -110,7 +110,7 @@
                     const response = await fetch(`/api/v1/UserManagement/${userId}`, {
                         method: 'DELETE',
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         }
                     })
@@ -127,7 +127,7 @@
                     const response = await fetch('/api/v1/UserManagement/', {
                         method: 'POST',
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         },
                         body: JSON.stringify({
@@ -150,7 +150,7 @@
 
                     const response = await fetch('/api/v1/UserManagement', {
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         }
                     })
diff --git a/src/Nager.Authentication.TestProject.WebApp/wwwroot/test.html b/src/Nager.Authentication.TestProject.WebApp/wwwroot/test.html
index f0c6da9..b7b29a6 100644
--- a/src/Nager.Authentication.TestProject.WebApp/wwwroot/test.html
+++ b/src/Nager.Authentication.TestProject.WebApp/wwwroot/test.html
@@ -55,7 +55,7 @@
                 }
             },
             computed: {
-                token() {
+                authenticationToken() {
                     return localStorage.getItem(tokenKey);
                 }
             },
@@ -67,7 +67,7 @@
 
                     const response = await fetch('/api/v1/UtcTime', {
                         headers: {
-                            "Authorization": `Bearer ${this.token}`,
+                            "Authorization": `Bearer ${this.authenticationToken}`,
                             "Content-Type": 'application/json'
                         }
                     })
diff --git a/src/Nager.Authentication.UnitTest/UserServiceTest.cs b/src/Nager.Authentication.UnitTest/UserServiceTest.cs
index e64b3e9..7fa41f4 100644
--- a/src/Nager.Authentication.UnitTest/UserServiceTest.cs
+++ b/src/Nager.Authentication.UnitTest/UserServiceTest.cs
@@ -47,12 +47,12 @@ public async Task ValidateCredentialsAsync_10Retrys_Block()
 
             for (var i = 0; i <= 10; i++)
             {
-                var authenticationStatus = await userService.ValidateCredentialsAsync(authenticationRequest);
-                Assert.AreEqual(AuthenticationStatus.Invalid, authenticationStatus, $"Retry: {i}");
+                var authenticationResult = await userService.ValidateCredentialsAsync(authenticationRequest);
+                Assert.AreEqual(AuthenticationStatus.Invalid, authenticationResult.Status, $"Retry: {i}");
             }
 
-            var authenticationStatus1 = await userService.ValidateCredentialsAsync(authenticationRequest);
-            Assert.AreEqual(AuthenticationStatus.TemporaryBlocked, authenticationStatus1);
+            var authenticationResult1 = await userService.ValidateCredentialsAsync(authenticationRequest);
+            Assert.AreEqual(AuthenticationStatus.TemporaryBlocked, authenticationResult1.Status);
         }
 
         [TestMethod]
@@ -87,8 +87,8 @@ public async Task ValidateCredentialsAsync_UpperCaseUsername_Allow()
                 Password = "secretPassword"
             };
 
-            var authenticationStatus = await userService.ValidateCredentialsAsync(authenticationRequest);
-            Assert.AreEqual(AuthenticationStatus.Valid, authenticationStatus);
+            var authenticationResult = await userService.ValidateCredentialsAsync(authenticationRequest);
+            Assert.AreEqual(AuthenticationStatus.Valid, authenticationResult.Status);
         }
     }
 }
diff --git a/src/Nager.Authentication/Helpers/ByteHelper.cs b/src/Nager.Authentication/Helpers/ByteHelper.cs
new file mode 100644
index 0000000..fd7c6e8
--- /dev/null
+++ b/src/Nager.Authentication/Helpers/ByteHelper.cs
@@ -0,0 +1,23 @@
+using System.Security.Cryptography;
+
+namespace Nager.Authentication.Helpers
+{
+    /// <summary>
+    /// Byte Helper
+    /// </summary>
+    public static class ByteHelper
+    {
+        /// <summary>
+        /// Generate a secure Pseudo-Random Number Generator
+        /// </summary>
+        /// <returns></returns>
+        public static byte[] CreatePseudoRandomNumber(int bit = 128)
+        {
+            var temp = new byte[bit / 8];
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(temp);
+
+            return temp;
+        }
+    }
+}
diff --git a/src/Nager.Authentication/Helpers/InitialUserHelper.cs b/src/Nager.Authentication/Helpers/InitialUserHelper.cs
index 2a1fcce..6dd1575 100644
--- a/src/Nager.Authentication/Helpers/InitialUserHelper.cs
+++ b/src/Nager.Authentication/Helpers/InitialUserHelper.cs
@@ -5,7 +5,7 @@
 namespace Nager.Authentication.Helpers
 {
     /// <summary>
-    /// InitialUserHelper
+    /// Initial User Helper
     /// </summary>
     public static class InitialUserHelper
     {
diff --git a/src/Nager.Authentication/Helpers/PasswordHelper.cs b/src/Nager.Authentication/Helpers/PasswordHelper.cs
index 3908b90..e82e33f 100644
--- a/src/Nager.Authentication/Helpers/PasswordHelper.cs
+++ b/src/Nager.Authentication/Helpers/PasswordHelper.cs
@@ -5,25 +5,12 @@
 namespace Nager.Authentication.Helpers
 {
     /// <summary>
-    /// PasswordHelper
+    /// Password Helper
     /// </summary>
     public static class PasswordHelper
     {
         private const int IterationCount = 10_000;
 
-        /// <summary>
-        /// Generate a 128-bit salt using a secure PRNG
-        /// </summary>
-        /// <returns></returns>
-        public static byte[] CreateSalt()
-        {
-            var salt = new byte[128 / 8];
-            using var rng = RandomNumberGenerator.Create();
-            rng.GetBytes(salt);            
-
-            return salt;
-        }
-
         /// <summary>
         /// Derive a 256-bit subkey (use HMACSHA1 with 10,000 iterations)
         /// </summary>
diff --git a/src/Nager.Authentication/Helpers/RoleHelper.cs b/src/Nager.Authentication/Helpers/RoleHelper.cs
index c8c099c..060d0e2 100644
--- a/src/Nager.Authentication/Helpers/RoleHelper.cs
+++ b/src/Nager.Authentication/Helpers/RoleHelper.cs
@@ -4,7 +4,7 @@
 namespace Nager.Authentication.Helpers
 {
     /// <summary>
-    /// RoleHelper
+    /// Role Helper
     /// </summary>
     public static class RoleHelper
     {
diff --git a/src/Nager.Authentication/Services/UserAccountService.cs b/src/Nager.Authentication/Services/UserAccountService.cs
index ae95460..9938ccf 100644
--- a/src/Nager.Authentication/Services/UserAccountService.cs
+++ b/src/Nager.Authentication/Services/UserAccountService.cs
@@ -12,7 +12,7 @@
 namespace Nager.Authentication.Services
 {
     /// <summary>
-    /// UserAccount Service
+    /// User Account Service
     /// </summary>
     public class UserAccountService : IUserAccountService
     {
@@ -20,6 +20,12 @@ public class UserAccountService : IUserAccountService
         private readonly IUserRepository _userRepository;
         private readonly string _issuer;
 
+        /// <summary>
+        /// User Account Service
+        /// </summary>
+        /// <param name="userRepository"></param>
+        /// <param name="configuration"></param>
+        /// <param name="logger"></param>
         public UserAccountService(
             IUserRepository userRepository,
             IConfiguration configuration,
@@ -46,40 +52,64 @@ public async Task<bool> ChangePasswordAsync(
             var passwordHash = PasswordHelper.HashPasword(userUpdatePasswordRequest.Password, userEntity.PasswordSalt);
             userEntity.PasswordHash = passwordHash;
 
-            await this._userRepository.UpdateAsync(userEntity);
+            await this._userRepository.UpdateAsync(userEntity, cancellationToken);
 
             return true;
         }
 
-        /// <inheritdoc />
-        public async Task<string?> GetMfaActivationQrCodeAsync(
+        private async Task<bool> CreateMfaSecretAsync(
             string emailAddress,
             CancellationToken cancellationToken = default)
         {
             var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress.Equals(emailAddress), cancellationToken);
             if (userEntity == null)
             {
-                return null;
+                return false;
             }
 
             if (userEntity.mfaSecret == null)
             {
-                userEntity.mfaSecret = PasswordHelper.CreateSalt();
-                if (!await this._userRepository.UpdateAsync(userEntity))
-                {
-                    this._logger.LogError("Cannot update mfaSecret");
-                    return null;
-                }
+                userEntity.mfaSecret = ByteHelper.CreatePseudoRandomNumber();
+                return await this._userRepository.UpdateAsync(userEntity, cancellationToken);
+            }
+
+            return true;
+        }
+
+        /// <inheritdoc />
+        public async Task<MfaActivationResult> ActivateMfaAsync(
+            string emailAddress,
+            string token,
+            CancellationToken cancellationToken = default)
+        {
+            var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress.Equals(emailAddress), cancellationToken);
+            if (userEntity == null)
+            {
+                return MfaActivationResult.UserNotFound;
+            }
+
+            if (userEntity.mfaActive)
+            {
+                return MfaActivationResult.AlreadyActive;
             }
 
             var twoFactorAuthenticator = new TwoFactorAuthenticator();
-            var setupCode = twoFactorAuthenticator.GenerateSetupCode(this._issuer, emailAddress, userEntity.mfaSecret);
+            if (twoFactorAuthenticator.ValidateTwoFactorPIN(userEntity.mfaSecret, token))
+            {
+                userEntity.mfaActive = true;
+                if (await this._userRepository.UpdateAsync(userEntity, cancellationToken))
+                {
+                    return MfaActivationResult.Success;
+                }
 
-            return setupCode.QrCodeSetupImageUrl;
+                return MfaActivationResult.Failed;
+            }
+
+            return MfaActivationResult.InvalidCode;
         }
 
         /// <inheritdoc />
-        public async Task<bool> ActivateMfaAsync(
+        public async Task<MfaDeactivationResult> DeactivateMfaAsync(
             string emailAddress,
             string token,
             CancellationToken cancellationToken = default)
@@ -87,17 +117,62 @@ public async Task<bool> ActivateMfaAsync(
             var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress.Equals(emailAddress), cancellationToken);
             if (userEntity == null)
             {
-                return false;
+                return MfaDeactivationResult.UserNotFound;
+            }
+
+            if (!userEntity.mfaActive)
+            {
+                return MfaDeactivationResult.NotActive;
             }
 
             var twoFactorAuthenticator = new TwoFactorAuthenticator();
             if (twoFactorAuthenticator.ValidateTwoFactorPIN(userEntity.mfaSecret, token))
             {
-                userEntity.mfaActive = true;
-                return await this._userRepository.UpdateAsync(userEntity);
+                userEntity.mfaActive = false;
+                userEntity.mfaSecret = null;
+
+                if (await this._userRepository.UpdateAsync(userEntity, cancellationToken))
+                {
+                    return MfaDeactivationResult.Success;
+                }
+
+                return MfaDeactivationResult.Failed;
+            }
+
+            return MfaDeactivationResult.InvalidCode;
+        }
+
+        public async Task<MfaInformation> GetMfaInformationAsync(
+            string emailAddress,
+            CancellationToken cancellationToken = default)
+        {
+            var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress.Equals(emailAddress), cancellationToken);
+            if (userEntity == null)
+            {
+                return null;
+            }
+
+            if (userEntity.mfaActive)
+            {
+                return new MfaInformation
+                {
+                    IsActive = true
+                };
             }
 
-            return false;
+            if (!await this.CreateMfaSecretAsync(emailAddress, cancellationToken))
+            {
+                return null;
+            }
+
+            var twoFactorAuthenticator = new TwoFactorAuthenticator();
+            var setupCode = twoFactorAuthenticator.GenerateSetupCode(this._issuer, emailAddress, userEntity.mfaSecret);
+
+            return new MfaInformation
+            {
+                IsActive = false,
+                ActivationQrCode = setupCode.QrCodeSetupImageUrl
+            };
         }
     }
 }
diff --git a/src/Nager.Authentication/Services/UserAuthenticationService.cs b/src/Nager.Authentication/Services/UserAuthenticationService.cs
index 26e422c..908bdf8 100644
--- a/src/Nager.Authentication/Services/UserAuthenticationService.cs
+++ b/src/Nager.Authentication/Services/UserAuthenticationService.cs
@@ -116,7 +116,7 @@ private async Task<bool> IsIdentifierBlockedAsync(string identifier)
         }
 
         /// <inheritdoc />
-        public async Task<AuthenticationStatus> ValidateCredentialsAsync(
+        public async Task<AuthenticationResult> ValidateCredentialsAsync(
             AuthenticationRequest authenticationRequest,
             CancellationToken cancellationToken = default)
         {
@@ -133,13 +133,21 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
             if (await this.IsIdentifierBlockedAsync(authenticationRequest.IpAddress))
             {
                 this._logger.LogWarning($"{nameof(ValidateCredentialsAsync)} - Block {authenticationRequest.IpAddress}");
-                return AuthenticationStatus.TemporaryBlocked;
+
+                return new AuthenticationResult
+                {
+                    Status = AuthenticationStatus.TemporaryBlocked
+                };
             }
 
             if (await this.IsIdentifierBlockedAsync(authenticationRequest.EmailAddress))
             {
                 this._logger.LogWarning($"{nameof(ValidateCredentialsAsync)} - Block {authenticationRequest.EmailAddress}");
-                return AuthenticationStatus.TemporaryBlocked;
+
+                return new AuthenticationResult
+                {
+                    Status = AuthenticationStatus.TemporaryBlocked
+                };
             }
 
             var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress == authenticationRequest.EmailAddress, cancellationToken);
@@ -148,13 +156,20 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
                 this.SetInvalidLogin(authenticationRequest.IpAddress);
                 this.SetInvalidLogin(authenticationRequest.EmailAddress);
 
-                return AuthenticationStatus.Invalid;
+                return new AuthenticationResult
+                {
+                    Status = AuthenticationStatus.Invalid
+                };
             }
 
             if (userEntity.IsLocked)
             {
                 this._logger.LogWarning($"{nameof(ValidateCredentialsAsync)} - User is locked {authenticationRequest.EmailAddress}");
-                return AuthenticationStatus.Invalid;
+
+                return new AuthenticationResult
+                {
+                    Status = AuthenticationStatus.Invalid
+                };
             }
 
             if (userEntity.PasswordHash == null)
@@ -169,7 +184,19 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
             {
                 if (userEntity.mfaActive)
                 {
-                    return AuthenticationStatus.MfaCodeRequired;
+                    var mfaIdentifier = Guid.NewGuid().ToString();
+                    var cacheKey = this.GetCacheKey(mfaIdentifier);
+
+                    this._memoryCache.Set(cacheKey, authenticationRequest.EmailAddress, new MemoryCacheEntryOptions
+                    {
+                        AbsoluteExpirationRelativeToNow = TimeSpan.FromSeconds(120)
+                    });
+
+                    return new AuthenticationResult
+                    {
+                        Status = AuthenticationStatus.MfaCodeRequired,
+                        MfaIdentifier = mfaIdentifier
+                    };
                 }
 
                 this.SetValidLogin(authenticationRequest.IpAddress);
@@ -177,7 +204,10 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
 
                 await this._userRepository.SetLastSuccessfulValidationTimestampAsync(o => o.Id == userEntity.Id, cancellationTokenSource.Token);
 
-                return AuthenticationStatus.Valid;
+                return new AuthenticationResult
+                {
+                    Status = AuthenticationStatus.Valid
+                };
             }
 
             this.SetInvalidLogin(authenticationRequest.IpAddress);
@@ -185,7 +215,10 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
 
             await this._userRepository.SetLastValidationTimestampAsync(o => o.Id == userEntity.Id, cancellationTokenSource.Token);
 
-            return AuthenticationStatus.Invalid;
+            return new AuthenticationResult
+            {
+                Status = AuthenticationStatus.Invalid
+            };
         }
 
         /// <inheritdoc />
@@ -210,21 +243,41 @@ public async Task<AuthenticationStatus> ValidateCredentialsAsync(
         }
 
         /// <inheritdoc />
-        public async Task<bool> ValidateTokenAsync(
-            string emailAddress,
+        public async Task<ValidateTokenResult> ValidateTokenAsync(
+            string mfaIdentifier,
             string token,
             CancellationToken cancellationToken = default)
         {
+            var cacheKey = this.GetCacheKey(mfaIdentifier);
+            if (!this._memoryCache.TryGetValue<string>(cacheKey, out var emailAddress))
+            {
+                return new ValidateTokenResult
+                {
+                    Success = false
+                };
+            }
+
+            this._memoryCache.Remove(cacheKey);
+
             var timeTolerance = TimeSpan.FromSeconds(20);
 
             var userEntity = await this._userRepository.GetAsync(o => o.EmailAddress == emailAddress);
             if (userEntity == null)
             {
-                return false;
+                return new ValidateTokenResult
+                {
+                    Success = false
+                };
             }
 
             var twoFactorAuthenticator = new TwoFactorAuthenticator();
-            return twoFactorAuthenticator.ValidateTwoFactorPIN(userEntity.mfaSecret, token, timeTolerance);
+            var isTokenValid = twoFactorAuthenticator.ValidateTwoFactorPIN(userEntity.mfaSecret, token, timeTolerance);
+
+            return new ValidateTokenResult
+            {
+                Success = isTokenValid,
+                EmailAddress = emailAddress
+            };
         }
     }
 }
diff --git a/src/Nager.Authentication/Services/UserManagementService.cs b/src/Nager.Authentication/Services/UserManagementService.cs
index c76fa64..4bf28dc 100644
--- a/src/Nager.Authentication/Services/UserManagementService.cs
+++ b/src/Nager.Authentication/Services/UserManagementService.cs
@@ -12,13 +12,18 @@
 namespace Nager.Authentication.Services
 {
     /// <summary>
-    /// UserManagement Service
+    /// User Management Service
     /// </summary>
     public class UserManagementService : IUserManagementService
     {
         private readonly ILogger<UserManagementService> _logger;
         private readonly IUserRepository _userRepository;
 
+        /// <summary>
+        /// User Management Service
+        /// </summary>
+        /// <param name="logger"></param>
+        /// <param name="userRepository"></param>
         public UserManagementService(
             ILogger<UserManagementService> logger,
             IUserRepository userRepository)
@@ -93,7 +98,7 @@ public async Task<string> ResetPasswordAsync(
 
             var randomPassword = PasswordHelper.CreateRandomPassword(10);
 
-            var passwordSalt = PasswordHelper.CreateSalt();
+            var passwordSalt = ByteHelper.CreatePseudoRandomNumber();
             var passwordHash = PasswordHelper.HashPasword(randomPassword, passwordSalt);
 
             userEntity.PasswordSalt = passwordSalt;
@@ -121,7 +126,7 @@ public async Task<bool> CreateAsync(
 
             var userId = Guid.NewGuid().ToString();
 
-            var passwordSalt = PasswordHelper.CreateSalt();
+            var passwordSalt = ByteHelper.CreatePseudoRandomNumber();
             var passwordHash = PasswordHelper.HashPasword(createUserRequest.Password, passwordSalt);
 
             var userEntity = new UserEntity