What Is 2FA?
Author: Domeny.ForSale editorial team Published
In brief: 2FA stands for two-factor authentication: confirming your identity when logging in using two different types of security, such as a password and a code from an app on your phone. This means that stealing your password alone is usually not enough to access your account. If the service offers a choice, prefer a security key or an authenticator app over SMS, and set up a way to recover access straight away.
How does 2FA work, and what do the two factors mean?
Authentication means checking whether the person trying to log in is who they claim to be. A password confirms knowledge of a secret, but it can be obtained through deception, guessed or exposed in a data breach. 2FA adds a second, independent type of confirmation.
Authentication factors fall into three basic categories:
- Something you know — such as a password or PIN.
- Something you have — such as a security key or a phone with an app that generates codes.
- Something you are — such as a biometric characteristic checked by a fingerprint reader.
A password and the answer to a question about your mother’s maiden name do not constitute true 2FA: both rely on knowledge. Likewise, completing two steps when logging in does not necessarily mean using two different factors. MFA stands for multi-factor authentication; 2FA is a form of MFA that uses exactly two factors.
For example, you log in to your email with a password, then enter a code from an authenticator app. Someone who obtained your password from a breach at another service cannot log in using that password alone — they also need the second factor or a way to bypass the security measures.
SMS, an app or a security key?
2FA methods differ in convenience and resistance to attacks. The available options depend on the service, so check its current security documentation before setting them up.
| Method | How it works | Main limitation |
|---|---|---|
| SMS | The service sends a code to your phone number. | Taking over the number, for example through the unauthorised issue of a new SIM card, may allow an attacker to receive the codes. |
| Code-generating app | The app generates short-lived codes, usually using the TOTP standard. | A code can be obtained through deception on a fake login page. |
| App notification | You approve a login request on your phone. | Accidentally approving someone else’s attempt may give an attacker access. |
| FIDO2/WebAuthn security key | You confirm the login using a physical device, for example via USB or NFC. | You need to arrange a backup way to log in in case you lose the key. |
TOTP is a one-time code based on the time and a secret stored during setup. Once an account has been added, the app can generate these codes without an internet connection or mobile network coverage. However, the time on the device must be set correctly.
Keys using the FIDO2/WebAuthn standard bind authentication to the service’s correct domain. This is an important advantage over codes: a typical fake website cannot use that confirmation to log in to the real account. This is a particularly good choice for business email, domain registrar control panels and administrator accounts.
If a service offers only SMS, enabling it is usually better than relying on a password alone. However, do not treat all methods as equally secure.
What does 2FA protect against, and what will it not stop?
2FA reduces the risk of an account being taken over after a password is exposed. It also helps when a criminal automatically tests passwords from data breaches across different services. However, it does not replace a unique password for each account.
Phishing, or impersonating a trusted service to trick people into revealing information, can also target 2FA codes. A fake page may ask for your password and current code, then pass them on to the real service. For this reason, do not give codes to a support representative, send them in a message or enter them on a page opened through a suspicious link.
2FA also does not protect against every consequence of a device becoming infected. Theft of an active session — the data that lets a service remember a logged-in user — may allow an attacker to bypass logging in again. System updates, caution when installing extensions and checking your account’s active sessions are still necessary.
Do not approve a login notification if you did not initiate the login. An unexpected request may mean that someone knows your password; navigate to your account settings yourself and check its activity.
How can you enable 2FA without losing access?
Start with your main email account, as it is often used to reset passwords for other services. Next, secure your password manager, financial accounts and control panels that let you manage your business, domain or hosting.
- Open your account’s security settings. Look for an option called “two-factor authentication”, “two-step verification” or “MFA”.
- Add your chosen method. With an app, you usually scan a QR code and enter the generated confirmation code. Do not share the QR code — it contains the secret that allows further codes to be generated.
- Save your recovery codes. These are emergency codes that replace the second factor and are usually single-use. Keep them somewhere secure that you can access even after losing your phone, such as a printout in a locked compartment.
- Add a backup method if the service allows it. This could be a second security key. Remember that a weaker fallback method may weaken the protection of the entire account.
- Test logging in before finishing setup. Keep your existing session open and try logging in in a separate private browsing window.
Before changing phones, check your app’s official instructions for transferring accounts. Do not assume that the codes will transfer along with the SIM card. Remove the setup from the old device only after confirming that you can log in to all your important services on the new one.
Read also
