What Is Two-Factor Authentication (2FA)?

Two-factor authentication (2FA) adds a second check after your password. Even if someone steals your password, they cannot log in without the second factor.

The three types of factor

Authentication factors are traditionally grouped as:

• Something you know: a password or PIN.
• Something you have: your phone, a security key or a smart card.
• Something you are: a fingerprint or face scan.

2FA combines two different types, most commonly a password plus something you have.

Common 2FA methods, from weakest to strongest

1. SMS codes. Better than nothing, but vulnerable to SIM-swap attacks and interception.
2. Email codes. Only as secure as your email account.
3. Authenticator apps that generate six-digit codes every 30 seconds. Much stronger than SMS and work offline.
4. Push notifications that ask you to approve a login. Convenient, but beware of approving prompts you did not trigger.
5. Hardware security keys and passkeys. The strongest common option, and resistant to phishing because they verify the real website.

Which accounts to protect first

1. Email, because it can reset every other password.
2. Password manager.
3. Banking and payment apps.
4. Work accounts.
5. Social media, especially accounts linked to a business.

Do not lose access

When you enable 2FA, most services give you backup codes. Save them in your password manager or print them and keep them somewhere safe. If you rely on an authenticator app, check whether it can back up or transfer codes before changing phones.

2FA works best with strong passwords, not instead of them. Use a random password generator for the password and 2FA as the second lock.

Frequently asked questions

How does 2FA work?

How does 2FA work? After your password, the site asks for a second proof, usually a code from an authenticator app, a push approval or a security key. A stolen password alone is no longer enough. This is also called multi-factor authentication, or MFA.

Authenticator app vs SMS: which is safer?

In the authenticator app vs SMS comparison, apps are safer. SMS codes can be stolen through a SIM swap attack, while authenticator codes are generated on your device. Hardware security keys are stronger still.

What is phishing-resistant authentication?

Phishing-resistant authentication, such as passkeys and hardware security keys, checks the real website's domain before signing in, so a fake site cannot capture anything useful.