What is Two-Factor Authentication?
A security method requiring two different types of identification to access an account: something you know (password) plus something you have (phone, hardware key) or something you are (biometric). This significantly reduces the risk of unauthorized access even if your password is compromised.
Also known as: 2FA, MFA, Multi-Factor Authentication, Two-Step Verification
Two-Factor Authentication (2FA) adds a second layer of security beyond your password. Even if someone steals your password, they can't access your account without the second factor.
The Three Factors
- Something you know: Password, PIN
- Something you have: Phone, hardware key, smart card
- Something you are: Fingerprint, face, iris
True 2FA requires two different types—two passwords isn't 2FA.
Types of 2FA (Best to Worst)
Hardware Security Keys (Best)
- Physical devices like YubiKey
- Immune to phishing
- No batteries or connectivity needed
Authenticator Apps (Good)
- TOTP apps like Aegis, Authy, Google Authenticator
- Works offline
- Resistant to SIM swapping
Push Notifications (Acceptable)
- Approve login via app notification
- Convenient but requires internet
- Can be susceptible to fatigue attacks
SMS Codes (Avoid if Possible)
- Vulnerable to SIM swapping
- Can be intercepted
- Better than nothing, but barely
Why SMS 2FA Is Dangerous
Attackers can:
- Call your carrier pretending to be you
- Transfer your number to their SIM
- Receive your 2FA codes
- Access all your accounts
This "SIM swapping" attack has cost victims millions.
Best Practices
- Use hardware keys for critical accounts (email, financial)
- Use authenticator apps for everything else
- Save backup codes securely (password manager)
- Avoid SMS when other options exist
- Enable 2FA on your email first—it's the key to everything
Related Terms
Authentication
The process of verifying that someone or something is who or what they claim to be. Authentication answers 'Are you who you say you are?'—distinct from authorization, which answers 'What are you allowed to do?'
Hardware Security Key
A physical device used for authentication that provides the strongest form of two-factor authentication. Hardware keys are immune to phishing attacks because they cryptographically verify the legitimacy of the website before responding.
Password Manager
Software that securely stores and manages passwords and other credentials. Password managers generate strong, unique passwords for each account and encrypt them with a single master password, eliminating password reuse and the need to remember multiple complex passwords.
Related Tools
Have more questions?
Use our guided flow to get the right next privacy step for Two-Factor Authentication.
Open Guided Flow