Two-Factor Authentication Explained
Security - 3 min read - Published 2026-08-27 - Updated 2026-10-19
Two-factor authentication (2FA) means a password alone isn't enough to sign in. You also need a second proof, usually something you have, such as your phone or a small hardware key. Even if your password leaks in a breach or is caught by a phishing page, an attacker without the second factor can't get in.
It's one of the most effective security steps available to ordinary users, and it takes a few minutes to set up.
The three kinds of factor
Authentication factors are usually grouped as something you know (a password or PIN), something you have (a phone, a security key, a smart card) and something you are (a fingerprint or face). Two-factor means combining two different kinds. A password plus a security question is not true 2FA, because both are things you know and both can be stolen the same way.
SMS codes
The site texts a one-time code to your phone. It's far better than a password alone and works on any phone, but it's the weakest common option. In a SIM-swap attack, a criminal convinces your mobile carrier to move your number to their SIM card and then receives your codes. Texts can also be intercepted or forwarded by malware. If a site offers anything better, use that instead.
Authenticator apps (TOTP)
Apps such as Google Authenticator, Microsoft Authenticator or a password manager's built-in authenticator generate a new 6-digit code every 30 seconds. When you set one up, the site shows a QR code containing a shared secret. Your app stores the secret, and from then on both your phone and the site calculate the same code from the secret and the current time, using the time-based one-time password (TOTP) standard, RFC 6238. No network connection is needed after setup.
Because the code depends on the time, your phone's clock needs to be roughly right; a clock several minutes out can make codes fail. And because the secret lives on your device, losing the phone without a backup can lock you out, which is why backup codes matter.
Push notifications
Some services send a prompt to an app on your phone asking you to approve the sign-in. It's convenient, but attackers have exploited it with "MFA fatigue": sending prompt after prompt until a tired user taps Approve. Better implementations show a number on the login screen that you must match in the app. Never approve a sign-in you didn't start.
Security keys and passkeys
Hardware security keys (small USB or NFC devices) and passkeys use the FIDO2/WebAuthn standards. Instead of a code you type, the key performs a cryptographic handshake with the website. Crucially, it's tied to the site's real address, so a phishing site on a look-alike domain gets nothing useful - something codes can't offer, because a person can be tricked into typing a code into a fake page.
Passkeys apply the same technology using your phone, computer or password manager, unlocked with a fingerprint, face or PIN. Many major services now support them, and they can replace the password entirely.
Setting it up without locking yourself out
Start with the accounts that matter most: your email first (whoever controls it can reset your other passwords), then your password manager, banking, and main social and work accounts.
When you enable 2FA, the site usually offers backup codes: a list of one-time codes for when your phone isn't available. Save them somewhere safe and separate from your phone, such as a password manager or printed and stored at home. Where possible, register two methods, for example an authenticator app plus a security key, so losing one device isn't a crisis.
If you change phones, move your authenticator accounts before wiping the old one. Many authenticator apps now offer encrypted cloud backup or a transfer option, which makes this much easier.