The idea in one paragraph
Logging in normally relies on one thing: something you know, usually a password. Two-factor authentication, often shortened to 2FA, asks for a second, different kind of proof as well. Even if a thief has your password, they would still need the second item to get in.
The “factors” are usually grouped like this:
- Something you know: a password, passphrase or PIN.
- Something you have: a phone, a hardware key, an app that generates codes.
- Something you are: a fingerprint or face scan.
Two-factor authentication combines two of these. Asking for two passwords would not count, because both are the same kind of factor.
Why it matters
Passwords leak, get guessed and are tricked out of people. Large collections of leaked logins circulate after data breaches, and attackers try them against other sites. If you have fallen into the habit of password reuse, a single leak can open several accounts. A second factor means that a password alone is no longer enough.
It is not magic, but it blocks a large share of everyday takeover attempts, which is why many services and employers encourage or require it.
Common forms
Text message codes. A short code arrives by SMS and you type it in. This is widely available and easy to use. It is the weakest of the common forms, because messages can be intercepted in some situations and phone numbers can be taken over through carrier trickery. It is still much better than no second factor.
Authenticator app codes. An app on your phone generates a new code every short interval. Codes work without a mobile signal and are not sent over the phone network. If you replace your phone, you need a way to move the setup, so save the backup codes first.
Push approvals. The service sends a prompt to a trusted app on your phone, and you tap to approve. This is convenient, though attackers may spam prompts hoping you tap “approve” out of annoyance, sometimes called prompt fatigue. Deny any prompt you did not start, and consider changing the password if you get a flood of them.
Hardware security keys. A small physical device you plug in or tap. These are generally considered among the strongest options, partly because they check the real website address and so resist phishing. You should register a second key as a spare.
Biometrics and device unlock. A fingerprint or face scan usually unlocks something on your device, such as an app or a passkey, rather than being sent to the website itself.
Backup codes. Single-use codes for emergencies, as described below.
What it does not protect against
Two-factor authentication raises the bar but leaves gaps.
- Real-time phishing. A convincing fake login page can ask for your password and then your one-time code and pass both to the attacker immediately. Codes do not help if you hand them over. Hardware keys and passkeys are better here.
- Code requests by scammers. Someone pretending to be support may ask you to read out a code. Never share one.
- Malware on your device. It may capture sessions after you have logged in.
- Weak recovery routes. If a thief can reset your account by another path, they can sidestep the second factor. Setting up account recovery options carefully closes this gap.
How to turn it on sensibly
- Start with email. Your main email account can reset many others, so protect it first.
- Then financial accounts and anything with stored payment details, followed by social media and cloud storage.
- Choose the strongest option offered that you will actually use. An authenticator app or security key is generally preferable to text messages, but text messages are better than nothing.
- Save the backup codes in a secure place, offline or in a password manager.
- Add a spare method, such as a second key or a second device, so a lost phone does not lock you out.
- Test it by signing out and back in, so you know how it works before you need it.
Everyday tips
Many services let you mark a device as trusted so you are asked less often. That is fine for your own phone or laptop, and not for a shared computer. If you travel and your phone number changes, update your settings before you go. If you ever lose the phone that holds your codes, use your backup codes or recovery method straight away and then reset the second factor.
A few extra seconds at sign-in is a small price. Two-factor authentication will not make an account unbreakable, but it removes one of the most common ways in, which is usually a good trade.