What Is Two-Factor Authentication (2FA)?
✦ Key takeaways
- 2FA adds a second layer after your password, so stealing the password alone isn't enough.
- There are three factor types: something you know, something you have, something you are.
- Authenticator apps and security keys are far stronger than SMS codes, which can be intercepted.
- FIDO2/WebAuthn security keys resist phishing because they are bound to the real site's address.
A password alone is no longer enough. If it leaks or you're tricked on a phishing site, your account is exposed. That's where two-factor authentication (2FA) comes in: a second verification step requested after your password, so knowing the password alone isn't enough to get in.
Digital security rests on three factors: something you know like a password, something you have like your phone or a security key, and something you are like a fingerprint or face. 2FA combines two different factor types, so even if your password is stolen, the attacker still can't clear the second factor.
Invoice & Quotation Maker
Professional invoices that auto-calc & print/PDF in a minute.
Types of second factor
| Method | How it works | Security level |
|---|---|---|
| SMS text | Code sent to your phone | Low to medium |
| Authenticator app (TOTP) | Code changes every 30s | High |
| Push approval | Tap 'approve' on your phone | High |
| Security key (FIDO2) | Physical device you touch | Highest |
Why SMS is weaker
SMS codes are better than nothing, but they're the weakest option. They can be intercepted through SIM-swapping attacks — where the attacker convinces your carrier to move your number — or through flaws in telecom networks. Move to an authenticator app whenever you can.
How an authenticator app works
Authenticator apps use the TOTP standard (Time-based One-Time Password). When you enable it, the site shares a secret key stored in your app; both sides then generate the same code from that key and the current time. The code changes every 30 seconds and needs no internet, because it's a local math calculation synchronized with the server.
The gold standard: security keys
FIDO2/WebAuthn security keys are the strongest because they resist phishing by design. The key signs a cryptographic challenge bound to the real site's address, so if a fake phishing site tries to capture the signature it fails — the address doesn't match. This shuts down the most dangerous attacks that trick users into entering data on a fake page.
Practical advice
Turn on 2FA first for your email account, since it's the recovery key to everything else, then for banks and social networks. Keep your backup recovery codes somewhere safe, and ideally own two security keys (a primary and a backup) for your most important accounts.