Two-Factor Authentication: What It Is and Why It Matters

The quick answer

Two-factor authentication (2FA) requires two different kinds of evidence to sign in, commonly a password plus an authenticator app, hardware security key, or another approved method. Multifactor authentication (MFA) is the broader term for using more than one factor.

What counts as a factor?

Examples include something you know (a password), something you have (a security key or registered device), and something you are (biometric verification). Two passwords are not two different factor types.

Authenticator app, SMS, or security key?

Authenticator apps generate time-limited codes or approve sign-in prompts. SMS codes can be better than password-only access but face risks such as number takeover. Phishing-resistant methods such as FIDO2 security keys or passkeys offer stronger protection on supporting services because they verify the website they are authenticating to.

Turn it on deliberately

1. Open the real account's Security settings.
2. Choose multifactor or two-step verification.
3. Follow the site's setup process and verify the new method works.
4. Save recovery codes somewhere safe and separate from the device holding your authenticator.

Never share a code with a caller

A person who unexpectedly asks you to read a one-time code may be trying to sign in as you. Codes are for the login screen you intentionally opened, not for verifying a support caller's identity. Don't approve authenticator prompts you didn't initiate.

Think about the replacement phone now

Before changing phones, review your backup and recovery methods. Some work or school accounts must be registered again even if personal authenticator codes can be restored. Keeping a second approved method can save a painful lockout later.

Bottom line: two-factor authentication is not invincible, but it makes a stolen password much less useful.