What Is Two-Factor Authentication (2FA)?

Two-factor authentication — also called 2FA or two-step verification — is a login method that requires two separate pieces of proof before granting access to an account. The first factor is your password. The second factor is something additional: a code sent to your phone, a fingerprint, or a physical security key.

The logic is simple: even if someone steals your password, they still cannot get in without the second factor.

Why Passwords Alone Are Not Enough

Passwords get compromised in several ways: data breaches expose them, phishing tricks you into entering them on fake sites, or people reuse the same password across many services. Once someone has your password, a single-factor login offers no further barrier.

Two-factor authentication breaks this. A stolen password becomes significantly less useful if the attacker also needs your phone to complete the login.

The Three Types of Authentication Factors

Security systems use three categories:

Something you know: A password, PIN, or security question
Something you have: A phone, hardware token, or security key
Something you are: A fingerprint, face scan, or other biometric

Two-factor authentication combines any two of these. Most commonly: a password (something you know) plus a time-based code (something you have).

Common 2FA Methods

SMS codes: A six-digit code sent to your phone via text message. Convenient but the weakest form of 2FA — phone numbers can be hijacked through SIM swapping attacks.

Authenticator apps: Apps like Google Authenticator or Authy generate time-based codes that expire every 30 seconds. More secure than SMS because they work offline and cannot be intercepted via SIM swapping.

Push notifications: Some services send a push notification to a registered device asking you to approve the login. Simple and phishing-resistant.

Hardware security keys: Physical devices (like a YubiKey) you plug in or tap to authenticate. The most secure consumer option — largely immune to phishing. Used by high-security environments.

Biometrics: Face ID or fingerprint unlock on mobile. Technically a second factor when combined with a password, though most phone logins treat them as a primary factor.

When You Should Enable 2FA

Enable it everywhere it is available, but prioritize:

Email accounts (access to email enables password resets for everything else)
Banking and financial services
Cloud storage
Any account with payment information saved
Work accounts

The inconvenience — typing an extra code — is minor compared to the protection it provides.

Summary

Two-factor authentication requires a second proof of identity beyond your password, making unauthorized access much harder even when passwords are compromised. Authenticator apps are a good default choice; hardware keys offer the highest security. Enable it on any account that matters. For more on account security, see what the cloud is and what a VPN does.