What Is Two-Factor Authentication (2FA) and How It Works

Passwords have a fundamental problem: they can be stolen without you ever knowing. Data breaches expose billions of credentials every year. Phishing campaigns trick people into typing their passwords into fake login pages. Keyloggers capture keystrokes silently. In all these cases, the attacker now has exactly what they need to log in as you.

Two-factor authentication (2FA) changes the equation. Even with your password, an attacker cannot get in without a second piece of evidence that only you can provide.

The Three Factors

Authentication factors fall into three categories:

Something you know -- a password, PIN, or security question answer. Passwords are the most common, but they are also the weakest factor because they can be shared, stolen, or guessed.

Something you have -- a phone, a hardware security key, or a smart card. An attacker stealing your password from a database breach does not have your physical device.

Something you are -- biometrics like a fingerprint, face scan, or iris scan. These are convenient but have their own failure modes.

Two-factor authentication combines any two of these. In practice, most online 2FA combines something you know (password) with something you have (your phone).

Types of 2FA: Ranked by Security

Hardware security keys (strongest). Physical devices like YubiKeys that plug into USB or tap to NFC. They are immune to phishing because they cryptographically verify the domain before authenticating. Even if you are tricked into visiting a fake site, the key refuses to authenticate.

Authenticator apps (strong). Apps like Google Authenticator, Authy, or 1Password generate time-based one-time passwords (TOTP) that change every 30 seconds. The codes are generated offline and are tied to your specific account. Phishing attacks that capture a TOTP code have a very short window to use it before it expires.

Push notifications (moderate). Apps like Duo send a push notification to your phone asking you to approve a login. These work well but are vulnerable to MFA fatigue attacks, where attackers send repeated approval requests hoping you accidentally tap Approve.

SMS codes (weak). One-time codes sent by text message. SIM swapping attacks redirect your phone number to an attacker's device, letting them receive your SMS codes. SMS is still better than no 2FA, but it should be replaced with an authenticator app wherever possible.

Email codes (weakest). Codes sent to your email are only as secure as your email account. If your email is compromised, this factor provides no additional protection.

Setting Up 2FA on Your Accounts

Most major platforms support 2FA under account security settings. The setup process is usually:

Go to Settings, then Security, then Two-Factor Authentication.
Choose your method (authenticator app is recommended).
Scan the QR code with your authenticator app.
Enter a code from the app to confirm setup.
Save your backup codes in a secure location -- you will need these if you lose your phone.

Start with your most critical accounts: email, password manager, banking, and workplace tools. Email is the highest priority because a compromised email account can be used to reset passwords on every other account.

What 2FA Does Not Protect Against

2FA is not a complete solution. Real-time phishing proxies can capture both your password and your TOTP code simultaneously and use them immediately before the code expires. Malware on your device can read codes from authenticator apps. Social engineering can convince you to share a code directly.

For the highest security, use hardware keys and a password manager that warns you when a login URL does not match the saved site.

The Bottom Line

Enable 2FA on every account that offers it, starting with email and working outward. Use an authenticator app instead of SMS wherever the option exists. For your most sensitive accounts, a hardware security key is the gold standard. The few seconds of friction it adds is far less painful than recovering a compromised account.