Two-factor authentication (2FA) is a login method that requires two different types of proof of identity – for example a password plus a code from a phone – instead of a password alone.
How 2FA works
Authentication factors fall into three categories: something you know (password, PIN), something you have (phone, security key, smart card) and something you are (fingerprint, face). 2FA combines two different categories; multi-factor authentication (MFA) is the general term. Common second factors, from weakest to strongest:
- SMS or voice codes – vulnerable to SIM swapping and interception;
- authenticator apps generating one-time codes (TOTP, RFC 6238);
- push notifications – convenient, but vulnerable to “MFA fatigue” spam unless number matching is used;
- FIDO2 / WebAuthn security keys and passkeys – phishing-resistant, because the key checks the website’s domain.
Why 2FA matters for security
Passwords leak through breaches, phishing and malware. With 2FA a stolen password alone is not enough, which blocks the vast majority of automated attacks such as credential stuffing. Attackers adapt: adversary-in-the-middle phishing kits steal one-time codes and session cookies in real time, and in the 2022 Uber breach an attacker spammed an employee with push requests until one was approved. That is why security agencies recommend phishing-resistant methods, especially for administrators.
Best practices
- Enable 2FA on email, banking, social networks and work accounts first.
- Prefer passkeys or hardware keys; use an authenticator app over SMS.
- Store backup codes safely and register a second key or device.
- Organizations: enforce MFA for all remote access and admin accounts, and protect MFA reset processes.
