What is two-factor authentication (2FA)?

Two-factor authentication (2FA) is a way of signing in that asks for a second check after the first one, which is usually your password. The second check uses a different kind of proof, such as a code sent to your phone or a 6-digit number shown in an authenticator app (a phone app that generates sign-in codes).

Passwords end up in other people’s hands more often than you might think: they get reused, typed into fake sites, or leaked in a breach at some service. With a second check in place, a password alone is no longer enough to get into your account. That matters for any account that receives your customer emails or the answers people submit through your class sign-up form.

What are authentication factors?

The ways to prove who you are fall into three broad kinds, called authentication factors.

Factor	What it means	Examples
Knowledge	Something only you know	A password, a PIN, the answer to a security question
Possession	Something only you have	A phone, a security key, an ID card
Inherence	Something you are	A fingerprint, your face

When you combine different kinds of factors, breaking one still leaves the other in place. Someone who steals your password still doesn’t have your phone. The US National Institute of Standards and Technology (NIST) calls these “something you know,” “something you have,” and “something you are,” and its digital identity guidelines require two distinct factors for its higher assurance levels.

Is two-step verification the same as two-factor authentication?

You will see two terms that sound alike:

• Two-step verification: signing in through two separate checks. The term is about the number of steps.
• Two-factor authentication: using two different kinds of factors. The term is about the kinds of proof.

Comparing a few combinations makes the difference clear.

Combination	Number of checks	Factors
Password + security question	Two steps	Not two-factor, since both are knowledge
Password + authenticator app code	Two steps	Two-factor: knowledge + possession
Passkey that checks your fingerprint or PIN	One action	Two-factor: possession + inherence (or knowledge)

In everyday use, though, the terms get mixed up. Google calls its feature “2-Step Verification,” and Apple calls its own “two-factor authentication,” yet both use something you have, such as your phone, as the second check. So when a service says “two-step verification,” it is effectively two-factor authentication as long as the second step uses something you have. What really matters is not the name but whether the second check is a different kind of factor from the first.

What can you use as the second factor?

Method	How it works	What to watch for
SMS code	A code is texted to your phone number	If someone takes over your number, for example by tricking your carrier into moving it to a new SIM card, the codes go to them
Authenticator app code	The app makes a new code every short interval	You need to move it over when you change phones
Push approval	You tap “Yes” on a notification on your phone	Never approve a prompt when you aren’t signing in yourself
Passkey or security key	A key on your device or security key signs a challenge	Plan for what happens if you lose the device or key

SMS is easy, and almost everyone can use it right away. NIST, however, classifies sending codes over the phone network as “restricted” and requires services that use it to offer other options as well. When you have a choice, an authenticator app or a passkey is the safer pick.

How do authenticator app codes work?

Authenticator apps generate codes with a method called TOTP, short for time-based one-time password. It is described in the IETF’s RFC 6238, and most authenticator apps and services support it.

1. During setup, you scan a QR code that the service shows you. Now the service and your app share the same secret value.
2. When you sign in, the app combines the secret with the current time to calculate a code, typically 6 digits. A new code every 30 seconds is the common setting.
3. The service does the same calculation and lets you in if the codes match.

Because the code depends only on the secret and the time, the app can make codes even without an internet connection. It also means that anyone who sees the setup QR code or secret can make the same codes, so don’t send screenshots of it to anyone.

How well does 2FA protect against phishing?

2FA does a good job of stopping someone who only has your stolen password. But methods where you type in a code can’t fully stop phishing, which is when someone lures you to a fake copy of a real site.

Some fake sites pass whatever you type straight through to the real site, live. Say you run a class and get a fake sign-in page for your booking system. If you enter your password and then your authenticator code, the attacker can use that code on the real site before it expires and get in. A code has no way of knowing which site it was typed into.

Passkeys and security keys hold up much better here. Their keys are tied to the real site’s domain, its address on the web, so they are never used on a fake domain. NIST’s guidelines say the same thing: methods where you type in a code do not count as phishing-resistant, while methods like WebAuthn (the technology behind passkeys) that verify the site you are talking to do. For more, see “What is a passkey?”

If you use code-based 2FA, a few habits go a long way:

• Sign in from a bookmark or by typing the address yourself, not from links in emails or text messages.
• Before entering a code, check the domain in your browser’s address bar.
• Ignore codes and approval prompts that arrive when you aren’t signing in.

How can you prepare for losing your phone?

If your second check depends on your phone, losing or breaking it can lock you out. A little preparation at setup time avoids that.

• Store your backup codes. Some services, Google among them, give you a set of single-use backup codes when you turn on 2FA. Each code works once. Print them and keep them with your important papers, or save them in a password manager. Some services cancel the old set when you generate a new one, so store the new set if you do.
• Check how your authenticator app backs up. Some apps can sync the secrets behind your codes to an account. If yours doesn’t, move your codes over before you switch phones.
• Don’t rely on a single second factor. Registering a security key or a passkey alongside your authenticator app means you can still get in if one stops working.

Summary

Two-factor authentication adds a second, different check to your password, so a leaked password alone doesn’t open your account. “Two-step verification” counts the steps and “two-factor authentication” counts the kinds of proof, but what matters is that the second check is a different kind of factor. SMS is weak against phone number takeover, typed codes are weak against phishing, and passkeys and security keys hold up against both. Keep your backup codes somewhere safe, and losing your phone becomes something you can handle calmly.