Two-Factor Authentication Explained

What two-factor authentication is

Two-factor authentication (2FA) requires two separate proofs of identity to log into an account: something you know (your password) and something you have (a phone that receives or generates a code, or a hardware key) or something you are (a fingerprint or face scan). Even if an attacker has your exact username and password — whether through a breach, phishing, or a keylogger — they cannot log in without the second factor. 2FA does not make a weak password strong, but it adds a layer that makes a compromised password much less catastrophic.

The four main types of 2FA

SMS codes are the most widely deployed form: a short numeric code, usually six digits, is sent to your phone by text message. SMS is better than no 2FA, but it is the weakest type. SIM-swapping attacks — where an attacker convinces a mobile carrier to transfer your number to their SIM card — bypass SMS 2FA completely. SMS is also vulnerable to real-time phishing where an attacker captures the code the moment you enter it on a fake site.

TOTP (Time-based One-Time Password) apps generate six-digit codes that change every 30 seconds. Apps like Google Authenticator and Aegis (Android) generate codes locally on your device without needing a network connection. TOTP codes can still be phished in real-time, but there is no SIM-swapping vulnerability. TOTP is considerably stronger than SMS against SIM swapping and is a sensible minimum for most people.

Hardware security keys (YubiKey, Google Titan Key) are physical devices you plug in or tap against your phone. They use public-key cryptography — the same technology as passkeys — and are phishing-resistant. A hardware key will not authenticate on a fake domain because the domain is part of the cryptographic challenge. Hardware keys are the gold standard for high-value accounts.

Passkeys are increasingly becoming the fourth and strongest form. A passkey combines authentication and the second factor into one: the cryptographic key stored on your device is something you have, and the biometric or PIN that unlocks it is the second factor. Passkeys are phishing-resistant by design.

Why SMS 2FA is better than nothing but not enough for important accounts

SIM-swapping has affected high-profile individuals including cryptocurrency holders, executives and celebrities. The attack requires only social engineering — persuading a mobile carrier's support staff that the attacker is the account holder and needs to transfer the number. Carriers have improved their verification processes, and since 2024 US FCC rules have required stronger authentication and customer notification for SIM changes, but the attack has not disappeared. For email, financial, and other high-value accounts, move away from SMS 2FA to TOTP or hardware keys.

How to enable 2FA on your accounts

Many major services (such as Google, Microsoft, Facebook, X and GitHub) support TOTP authentication, although some, including Apple, use their own verification-code system instead, and some banks offer only SMS or their own app. Go to account security settings, find the two-step verification or multi-factor authentication section, choose "Authenticator app", scan the QR code with your chosen app, and confirm with the first code. The process usually takes only a few minutes per account. Download your backup codes and store them securely — if you lose access to your authenticator app, backup codes are how you get back in.

What 2FA cannot protect you from

2FA does not protect against malware on your device that intercepts codes in real time. It does not protect against attackers who have already obtained a valid session token through a prior attack. And it cannot help if you lose your second factor and have no backup. These are edge cases for most users, but they illustrate that 2FA is one layer in a security stack, not a complete solution by itself. The foundation remains: a unique, strong password generated randomly, stored in a password manager, with 2FA enabled on every account that supports it.

How much does 2FA actually help?

Google published results from a study of account takeovers that tested how well different second factors blocked attacks. An SMS code sent to a recovery phone blocked 100% of automated bot attacks, 96% of bulk phishing attacks and 76% of targeted attacks. On-device prompts did better, blocking 100%, 99% and 90% respectively. Google also reported that no users who relied exclusively on security keys fell victim to targeted phishing during the study. The numbers show two things: any second factor stops the overwhelming majority of mass attacks, and the gap widens exactly where attackers are most determined, which is why phishing-resistant methods matter most for email, finance and work accounts.