What Is Two-Factor Authentication, and How Does It Work? (Explained Clearly) - 2FA vs MFA
Learn how two-factor authentication (2FA) and MFA work, compare SMS, authenticator apps, passkeys, and security keys to better protect your accounts.
Key Takeaways
Two-factor authentication (2FA) adds another layer of identity verification beyond a password. If someone steals, guesses, or reuses your password, they must still satisfy a second requirement before accessing your account.
Multi-factor authentication (MFA) follows the same principle but can use two or more types of evidence. Because most MFA systems require exactly two factors, the terms 2FA and MFA are often used interchangeably.
What Two-Factor Authentication Means
True two-factor authentication requires evidence from two different authentication-factor categories:
Join the conversation
See what others are saying, and add your own note in the YouTube comments.
Some links may earn a commission. Thanks for your support.
2FA requires two different factor types: something you know, have, or are; two passwords or a password plus PIN are only two-step verification.
MFA uses two or more distinct factors: all 2FA is MFA, but MFA can require three or more factors.
Passwords alone are vulnerable to reuse, breaches, phishing, malware, credential stuffing, and social engineering.
Prefer phishing-resistant authentication: security keys and properly implemented passkeys/WebAuthn provide the strongest practical protection.
Authenticator apps are stronger than SMS: TOTP codes work offline and avoid SIM-swap risks, but attackers can still phish them in real time.
SMS is better than password-only access, but it remains vulnerable to phishing, SIM swaps, interception, and phone-number takeover.
Never approve an unexpected push notification: repeated prompts may be an MFA-fatigue attack; number matching offers better protection than simple approve/deny prompts.
MFA does not prevent every compromise: attackers may steal authenticated sessions, infect devices, abuse recovery procedures, or enroll their own authentication factor.
Secure recovery as carefully as login: store recovery codes separately from passwords and register a backup key, device, or authenticator before you need it.
Protect high-impact accounts first: prioritize email, password managers, financial services, workplace/admin systems, cloud storage, and accounts that can reset others.
Review registered devices and factors regularly, and promptly remove lost, replaced, sold, or unfamiliar devices.
Use the strongest available option: choose passkeys or security keys first, an authenticator app second, and SMS when no stronger method is offered.
Something you know
Password
Passphrase
PIN
Device-unlock code
Something you have
Mobile phone
Authenticator app
Hardware security key
Smart card
Device containing a passkey
Something you are
Fingerprint
Face
Iris or another biometric characteristic
A password followed by a PIN is not true 2FA because both are knowledge factors. Similarly, two passwords provide two verification steps but not two independent factors.
The distinction matters because factors should be independent. An attack that compromises one type of evidence should not automatically compromise the other. The OWASP Multifactor Authentication Cheat Sheet explains that multiple instances of the same factor do not constitute MFA.
2FA vs MFA vs Two-Step Verification
Although these terms are related, they do not always mean exactly the same thing.
Term
Meaning
2FA
Authentication using exactly two distinct factor categories
MFA
Authentication using two or more distinct factor categories
2SV
A two-step verification process that may or may not use different factor categories
All 2FA is MFA, but an MFA system could require three factors—for example, a password, security key, and fingerprint.
Two-step verification describes the number of steps rather than the independence of the factors. A password followed by another PIN is two-step verification, but both are still “something you know.”
Why Passwords Alone Are Not Enough
Passwords have several weaknesses:
People reuse them across multiple websites.
Data breaches can expose them.
Attackers can capture them with fake login pages.
Malware may steal them from a device.
Automated tools can test breached credentials against other services.
Social engineering can persuade users or support staff to reset them.
Credential stuffing is a common example. Attackers take username-and-password combinations leaked by one service and test them on other websites. Password reuse can then turn one breach into several compromised accounts.
MFA changes the attacker’s task. A valid password may no longer be sufficient because the attacker must also control a registered device, obtain a temporary code, satisfy local biometric or PIN verification, or produce a cryptographic response from a registered key.
How Two-Factor Authentication Works
A typical password-and-code login follows these steps:
You enter your username and password.
The service verifies the password.
It requests a second factor.
You enter a temporary code, approve an app notification, or use a security key.
The service verifies the response.
It creates an authenticated session.
The second factor can stop many account-takeover attempts when an attacker has only the password.
Setting Up an Authenticator App
Authenticator apps commonly use Time-Based One-Time Passwords, or TOTP. Setup usually works like this:
Sign in to the account.
Open its security or authentication settings.
Select the authenticator-app option.
Scan the displayed QR code with the app.
Enter a generated code to confirm enrollment.
Save any recovery codes the service provides.
The QR code contains information that allows the app and service to calculate matching codes. The app commonly displays a six-digit code that changes every 30 seconds. TOTP is standardized in RFC 6238.
Because the code is generated locally, an authenticator app can work without cellular service. However, anyone who obtains the underlying setup secret may be able to generate valid codes.
How Passkeys and Security Keys Work
Passkeys and security keys use public-key cryptography rather than a shared code.
During enrollment, the authenticator creates a key pair:
The service stores the public key.
The private key remains protected by the device, credential provider, or hardware security key.
During login:
The legitimate website sends a new cryptographic challenge.
The authenticator checks which website is requesting access.
You authorize the operation using a touch, PIN, fingerprint, or face verification.
The authenticator signs the challenge with the private key.
The service verifies the signature with the public key.
Because the credential is associated with the legitimate website, a fake domain generally cannot use it to authenticate to the real service. This makes properly implemented WebAuthn credentials resistant to conventional credential phishing. Technical details are available in the W3C Web Authentication specification.
Common 2FA and MFA Methods Compared
Not every second factor provides the same level of protection.
Method
How it works
Main advantage
Main weakness
Email code or link
A code or link is sent to an email account
Easy to use
Security depends on the email account and its active sessions
SMS or voice code
A temporary code arrives through the telephone network
Familiar and widely available
Vulnerable to phishing, SIM swaps, and phone-number takeover
Authenticator-app code
An app generates a time-based code
Works offline and avoids SIM-swap exposure
The code can still be phished in real time
Hardware OTP token
A dedicated device displays a temporary code
Separate from a phone or computer
Codes remain phishable; hardware can be lost
Basic push notification
An app asks you to approve or deny a login
Fast and convenient
Vulnerable to accidental approval and MFA fatigue
Number-matching push
You match or enter a number shown during login
Better connection between the prompt and login
Still depends on careful user action
Security key
Hardware signs a challenge for the legitimate service
Strong phishing and replay resistance
Requires compatible hardware and loss planning
Passkey
A device or credential manager uses a cryptographic key
Phishing-resistant and may replace passwords
Availability, synchronization, sharing, and recovery vary
Smart card or certificate
A protected private key authenticates the holder, often with a PIN
SMS Two-Factor Authentication
SMS authentication sends a temporary code to a registered phone number. It is convenient and generally more protective than a password alone, but it is one of the weaker mainstream MFA methods.
Its risks include:
Fake websites that collect and relay the code
Social engineering
Message interception
Phone-number porting fraud
SIM swapping
A SIM swap occurs when a criminal persuades or tricks a mobile carrier into transferring a victim’s phone number to an attacker-controlled SIM. Calls and authentication messages then go to the attacker.
NIST classifies telephone-network authentication as a restricted authenticator and recommends considering signals such as SIM changes and number-porting activity. See NIST SP 800-63B for current authentication guidance.
SMS should not be treated as useless. It can still block attacks in which the criminal has only a stolen password. However, an authenticator app, passkey, or security key is preferable when available.
Authenticator Apps and TOTP Codes
Authenticator apps generate codes from a shared secret and the current time. Unlike SMS, the code is not delivered through the mobile telephone network, so SIM swapping alone does not provide access.
The main limitation is phishing. An attacker can create a fake login page, capture the password and current TOTP code, and immediately relay both to the real service before the code expires.
Authenticator apps are therefore stronger than SMS in several respects, but manually entered codes are not considered phishing-resistant.
Push Notifications and MFA Fatigue
Push authentication sends an approval request to a registered app. You may see information such as the service name, approximate location, browser, or requesting device.
Basic prompts that offer only Approve and Deny can be abused through MFA fatigue, also called push bombing. An attacker who already has the password repeatedly triggers login prompts, hoping the user will eventually approve one through confusion, habit, or annoyance.
Never approve a prompt you did not initiate.
Number matching improves push authentication by displaying a number in the login session that must be entered or selected in the app. It helps connect the approval to a specific login, although it still depends on user attention. CISA recommends number matching as an improvement while organizations move toward phishing-resistant authentication.
Security Keys, WebAuthn, and FIDO2
A hardware security key typically connects through USB, NFC, or another supported transport. Rather than displaying a reusable code, it cryptographically responds to a challenge associated with the legitimate website.
FIDO2 commonly includes:
WebAuthn, the interface used by browsers and web applications
CTAP, which supports communication between a client device and an external authenticator
Security keys are among the strongest practical options because they resist common phishing and replay attacks. A fraudulent website generally cannot obtain a valid authentication response for the legitimate service.
Users should register a backup key or another secure recovery method in case the primary key is lost or damaged.
Passkeys as a Password Replacement
A passkey is a FIDO credential designed to replace a traditional reusable password. It uses a cryptographic key pair and may be:
Device-bound, remaining on one authenticator
Synced, becoming available across a user’s authorized devices through an encrypted credential provider
Passkeys can be unlocked locally with a device PIN, fingerprint, or facial verification. In modern passkey systems, biometric information generally remains on the device. The website receives cryptographic proof rather than a copy of the raw fingerprint or face image. The FIDO Alliance specifications overview provides more information about this model.
A passkey is not necessarily an additional step after a password. It may replace the password entirely. Whether a particular passkey login formally satisfies multi-factor requirements depends on its implementation and whether local user verification is required.
Which 2FA Method Provides the Strongest Protection?
A practical ranking from stronger to weaker is:
Phishing-resistant cryptographic authentication
Hardware security keys
Properly implemented passkeys and WebAuthn
Suitable smart-card or certificate systems
Push authentication with number matching
Especially when prompts provide clear login context and are rate-limited
Authenticator-generated OTPs
TOTP authenticator apps
Hardware OTP tokens
Telephone-network authentication
SMS
Voice calls
Email codes
Highly dependent on the security of the email account
The strongest available option is not always practical. Device support, accessibility, cost, hardware availability, recovery requirements, and lockout risks all matter. A reasonable approach is to choose:
Passkeys or security keys when available
An authenticator app when cryptographic options are unavailable
SMS when it is the strongest method the service offers
Can Attackers Bypass MFA?
MFA significantly reduces account-takeover risk, but it is not a complete defense. Attackers may target the user, device, authenticated session, enrollment process, or recovery system instead of directly defeating the second factor.
Real-Time Phishing
A fake login page can collect a password and temporary code, then immediately submit them to the legitimate website. This attack particularly affects SMS, voice, and TOTP codes.
Properly implemented security keys and passkeys are more resistant because authentication is scoped to the legitimate website.
Session Theft
After successful authentication, a website usually issues a session cookie or token. It tells the service that the user has already logged in.
If malware or another vulnerability steals that token, an attacker may be able to impersonate the user without repeating MFA. Strong authentication therefore does not eliminate the need for secure session management. The OWASP Cookie Theft Mitigation Cheat Sheet covers this risk in more detail.
Compromised Devices
Malware may:
Capture passwords and temporary codes
Read notifications
Display fraudulent prompts
Control an authenticated browser
Steal session tokens
Manipulate transactions
MFA remains valuable, but it cannot guarantee security when the device being used is under hostile control.
Weak Account Recovery
Attackers may claim that a phone or security key was lost and attempt to convince support staff to disable MFA. If the recovery process uses weaker identity checks than normal login, it can become the easiest route into the account.
Malicious Factor Enrollment
Someone with temporary account access may register an attacker-controlled phone, passkey, or security key. This can preserve access even after the account owner changes the password.
Review registered devices and authentication methods regularly, particularly after suspicious activity.
Secure Account Recovery and Backup Factors
Recovery is part of the authentication system. Strong 2FA can be undermined if an attacker can reset it through an insecure recovery process.
Common recovery methods include:
One-time backup codes
A second registered security key
A second trusted device
Another authenticator registered to the account
A protected recovery contact
A verified support process
Protecting Recovery Codes
Recovery codes are sensitive credentials that can sometimes bypass the normal second factor. They should be:
Stored separately from the password
Kept in a secure password manager or protected offline location
Regenerated if exposed or copied unexpectedly
Marked as used when the service does not do so automatically
Do not leave the only copy on the phone whose loss would require the codes.
Preparing for a Lost or Replaced Phone
Before replacing or losing access to a device:
Confirm that recovery codes are accessible.
Register a backup authenticator or security key.
Transfer or synchronize passkeys where supported.
Export or re-enroll authenticator entries if necessary.
Remove the former device from the account.
Review the account for unknown factors.
Generate new recovery codes if the old ones may have been exposed.
Losing a phone does not automatically give a thief access. A locked device may still require a PIN or biometric. The greater immediate problem may be account lockout when no backup factor exists.
Trusted Devices and Remembered Logins
Many services offer a “remember this device” option. This usually does not disable MFA for the account. Instead, the service stores a long-lived token or cookie on that device so it does not request a second factor during every login.
MFA may be requested again when:
The trusted-device token expires
Browser data is deleted
A different device or browser is used
The password changes
Suspicious activity is detected
The login comes from an unusual network or location
A sensitive security or financial action is attempted
Remembered devices improve usability, but their stored tokens must also be protected. A copied session or trusted-device token can become a route around repeated MFA prompts.
Accounts That Should Use Two-Factor Authentication
Start with accounts that can reset other accounts or expose important personal, workplace, or financial information.
Email Accounts
Email should be a top priority because password-reset links for many other services are delivered there. A compromised inbox can become a gateway to additional accounts.
Financial Accounts
Enable the strongest available authentication for:
Online banking
Payment services
Credit-card accounts
Investment accounts
Cryptocurrency exchanges
Some financial services also require separate approval for transactions, such as sending money to a new recipient.
Workplace and Administrative Accounts
MFA is especially important for:
Remote-access systems and VPNs
Single sign-on portals
Cloud administration
Source-code repositories
Production systems
Privileged and administrative accounts
Administrative accounts can often create users, change security settings, access secrets, or disable defenses, making compromise particularly damaging.
Personal and Cloud Services
Protect accounts that store communications, identity information, or valuable data, including:
Social media
Cloud storage
Password managers
Healthcare portals
Government services
Education accounts
Shopping accounts with saved payment information
Practical 2FA Security Habits
Enabling MFA is only the first step. Use it carefully:
Never share a verification code with another person.
Do not approve an unexpected push notification.
Check the website address before entering a password or code.
Prefer passkeys or security keys when supported.
Use an authenticator app instead of SMS when practical.
Save recovery codes in a protected location.
Register a backup factor before one is urgently needed.
Review registered devices and authentication methods.
Remove lost, sold, or replaced devices promptly.
Reauthenticate before changing recovery information.
Investigate unexpected authentication prompts because they may indicate that someone already knows your password.
Two-factor authentication creates an additional barrier between an attacker and your digital accounts. It cannot prevent every form of compromise, but choosing a strong method and securing its recovery path makes a stolen password far less likely to become a stolen account.
FAQ
Quick answers to the questions people usually ask about this topic.
Can I use two-factor authentication without a smartphone?
Yes. Depending on the service, alternatives may include a USB or NFC security key, hardware OTP token, smart card, or codes sent by voice call. A hardware security key is generally the strongest of these options because it uses phishing-resistant cryptographic authentication rather than a manually entered code.
Why is my authenticator app code not working?
Common causes include entering an expired code, selecting the wrong account entry, or having an incorrect device clock. Wait for a new code, confirm that you are using the correct authenticator entry, and enable automatic date and time synchronization. If codes still fail, use a saved recovery method rather than repeatedly resetting MFA.
Is the QR code used to set up an authenticator app sensitive?
Yes. The QR code normally contains the shared secret used to generate TOTP codes. Anyone who copies that secret may be able to produce valid codes, so do not post screenshots, send the QR code through unprotected messages, or leave it visible. If it may have been exposed, remove and re-enroll the authenticator.
What should I do if I receive a 2FA code or approval request I did not initiate?
Do not share the code or approve the request. Sign in through the service’s official website or app, change any reused or exposed password, review recent account activity, and remove unknown devices or authentication methods. Repeated prompts may indicate that an attacker already knows your password and is attempting MFA fatigue or push bombing.
Can one account have multiple security keys or authenticator devices?
Many services allow multiple factors, although support varies. Registering a backup security key, authenticator, or trusted device can prevent lockout if the primary factor is lost. Keep backups physically secure and periodically review the account’s registered authentication methods.
Is it safe to keep passwords and TOTP codes in the same password manager?
It is convenient, but it concentrates both credentials in one system and reduces their independence if the password-manager vault or an authenticated device is compromised. It can still provide better protection than a password alone, especially against credential stuffing. For higher-risk accounts, consider a separate authenticator or a phishing-resistant security key or passkey.
Does using Face ID or a fingerprint mean a website receives my biometric data?
Generally, no. With properly implemented passkeys and WebAuthn, biometric verification occurs locally on the device. The website receives cryptographic proof that the credential was authorized, not a copy of the raw fingerprint or face image. See the W3C Web Authentication specification for technical details.
Are email verification codes considered strong 2FA?
Email codes provide an additional barrier, but their security depends heavily on the email account and its existing sessions. If an attacker already controls the inbox, they may also receive the code or reset the protected account. Secure the email account itself with a stronger method such as a passkey, security key, or authenticator app.
Should I turn off SMS 2FA if stronger methods are unavailable?
Usually not. SMS can still stop an attacker who has only obtained your password, so it is generally better than password-only authentication. However, it is vulnerable to phishing, SIM swapping, and phone-number takeover. Move to an authenticator app, passkey, or security key when the service supports one. NIST SP 800-63B treats telephone-network authentication as restricted.
When should I regenerate my 2FA recovery codes?
Generate new recovery codes if the existing ones were exposed, copied unexpectedly, lost, or stored on a missing device. You should also consider replacing them after an account compromise or suspicious recovery attempt. Store the new codes separately from the password and delete or destroy obsolete copies.
