Two-factor authentication (2FA) is a login method that requires two different types of evidence: something you know, such as a password, and something you have, such as a phone or security key. It is a specific case of multi-factor authentication.
Why it matters
A stolen password alone is no longer enough to take over an account, which blunts phishing, leaks and credential stuffing. Strength varies by method. Hardware security keys and passkeys resist phishing, authenticator app codes are good, and SMS codes are the weakest because phone numbers can be hijacked.
Example
After entering your password, the site asks for a six-digit code from an authenticator app. The app computes it from a shared secret and the current time using TOTP, and the code changes about every 30 seconds.
Common mistakes
- Relying on SMS when an app or hardware key is available.
- Not saving backup codes, which locks you out when the phone is lost.
- Approving unexpected push prompts. Repeated prompts can be an attack.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.