Glossary
Two-factor authentication
Two-factor authentication — 2FA — means signing in needs two things: something you know, your password, plus something you have, such as a code from an app on your phone or a physical security key.
What it means
Two-factor authentication — 2FA — means signing in needs two things: something you know, your password, plus something you have, such as a code from an app on your phone or a physical security key. With it turned on, a stolen password alone is not enough to get into your account. It is the single highest-value security step after unique passwords, and it should be on your email, banking and social media accounts first.
How it works
Not all second factors are equal. A hardware security key or a passkey is strongest, because it is tied to the real site and cannot be tricked into signing in to a lookalike. An authenticator app, which generates time-based codes, is next best: the codes change every thirty seconds and are not sent over any network. A code sent by text message is the weakest, because it can be intercepted or tricked out of you by a phone scam — but it is still far better than no second factor at all. When you turn two-factor authentication on, the service gives you recovery codes: single-use codes that are your way back in if you lose your phone. Save them the same day, stored safely on paper or in a locked note.
Example
Imagine a fictional user, Maria, whose password is stolen in a data breach. The attacker tries to log into her email — and is stopped, because the account asks for a code from the authenticator app on Maria's phone. The attacker has the password but not the phone, and the phone is in Maria's pocket. That is the whole point of the second factor: it makes the password alone worthless. Six months later Maria loses her phone — and gets back in using the recovery codes she had stored at home, because she saved them the day she turned the feature on.
Common misunderstandings
The most common misunderstanding is that two-factor authentication makes an account unbreakable. It does not: it makes one specific attack — using a stolen password — fail. An attacker who tricks you into entering the code on a fake site, or who convinces your phone company to move your number to their SIM, can still get in. Two-factor authentication is a strong layer, not a guarantee — and it works best alongside unique passwords, not instead of them.
Related terms
Learn more
- Password security fundamentals
- What are passkeys?
- What is identity theft?
- Password and Account Security
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Which second factor should I choose?
A security key or passkey is strongest, because it cannot be phished. An authenticator app is next best. A text-message code is weakest but still far better than nothing — start with whatever your service offers, then upgrade where you can.
What are recovery codes, and why do they matter?
Recovery codes are single-use codes the service gives you when you turn on two-factor authentication. They are your way back in if you lose your phone. Save them the same day, on paper at home or in a locked note — losing your phone and your recovery codes together is the most common way people lock themselves out.
Is two-factor authentication enough on its own?
No — it is one layer. It stops a stolen password being enough, but it does not replace unique passwords, and it cannot protect you if you enter the code on a fake site yourself. Use both: unique passwords and two-factor authentication together.