Two-factor authentication, commonly abbreviated 2FA, is an authentication method that requires a user to provide two distinct authentication factors before access is granted. The factors normally come from different categories: something the user knows, something the user has, or something the user is. A password is generally something the user knows. A physical security key or registered device can represent something the user has, while a fingerprint or facial characteristic can represent something the user is. The purpose of using two factors is to reduce the impact of compromise of one factor. If an attacker steals a password, for example, a properly implemented second factor can prevent access unless the attacker also possesses or can successfully use the second factor.
Two-factor authentication is a specific form of multifactor authentication, or MFA. MFA is the broader concept of requiring multiple authentication factors, while 2FA specifically involves two factors. The distinction between two steps and two factors is important. Entering a password and then answering a security question is generally two pieces of information from the same knowledge category rather than two independent factors. Similarly, entering a password twice does not constitute 2FA. Genuine 2FA requires different factor categories. Independence matters because the security benefit comes from requiring an attacker to compromise separate forms of authentication rather than merely providing multiple pieces of the same secret.
Common second factors include authenticator applications that generate time-based one-time passwords, hardware security keys, push notifications and one-time codes delivered through certain communication channels. SMS codes are widely used but have security limitations because telephone numbers can sometimes be compromised through SIM-swapping, number-porting attacks or interception. Push-based authentication can also be abused through repeated fraudulent prompts designed to cause the user to approve an unexpected request. Hardware security keys and passkeys based on public-key cryptography can provide stronger resistance to phishing because the authentication operation is cryptographically tied to the legitimate service.
One-time passwords are designed to be usable for a limited period or limited number of authentication events. Time-based one-time passwords, commonly called TOTP, are generated from a shared secret and the current time, usually using a standard algorithm such as HMAC-based processing. The resulting code changes periodically. Although TOTP provides a useful additional factor, a user can sometimes be tricked into entering the code into a phishing site that relays it to the genuine service in real time. Thus, 2FA does not automatically mean phishing-resistant authentication. The strength of the second factor depends on how it is implemented and whether an attacker can intercept, relay or socially engineer it.
Push authentication works by sending an approval request to a previously registered device. This can be convenient because the user may simply approve the notification rather than manually enter a code. However, attackers can exploit approval fatigue by generating repeated prompts in the hope that the victim eventually accepts one. Number matching and contextual information can reduce some of these attacks by requiring the user to confirm information displayed during the login process. Users should never approve an authentication request they did not initiate. Unexpected prompts can indicate that someone has obtained the password or is attempting to authenticate using another means.
Security keys and passkeys use public-key cryptography rather than relying on a reusable password shared with the service. During registration, a device creates a cryptographic key pair, with the private key protected by the device and the public key registered with the service. Authentication involves proving possession of the private key without transmitting it to the website. Modern passkey implementations can be resistant to phishing because the cryptographic operation is associated with the legitimate website origin. This is an important distinction from conventional one-time codes, which can potentially be entered into a fraudulent website and relayed to the real service.
Recovery is an essential part of 2FA security. If a user loses their second-factor device, they need a secure recovery method. Recovery codes can provide access when the primary second factor is unavailable, but they must be protected because possession of a valid recovery code can sometimes substitute for the normal second factor. Weak account-recovery procedures can undermine otherwise strong authentication if an attacker can persuade support staff or exploit a poorly protected reset process. Organisations should therefore secure registration, authentication and recovery equally carefully. Users should maintain appropriate recovery options without storing recovery secrets in publicly accessible or easily compromised locations.
Two-factor authentication substantially improves account security compared with password-only authentication, but its protection depends on the factors and implementation. A stolen password may be insufficient when a strong independent factor is required, while weaker second factors can sometimes be intercepted or socially engineered. Users should enable MFA wherever appropriate, prefer phishing-resistant methods such as passkeys or security keys when available, protect authentication devices and never approve unexpected prompts. Organisations should also monitor authentication events, provide secure recovery processes and apply appropriate access controls. 2FA is therefore best understood as one layer within a broader identity-security system rather than a guarantee that an account cannot be compromised.
