The idea in one sentence
A password is something you know. Two-factor authentication, often shortened to 2FA, adds a second kind of proof, so that signing in requires more than a single secret that could be guessed, leaked or tricked out of you.
The factors are traditionally grouped into three kinds: something you know (a password or PIN), something you have (a phone or a physical key), and something you are (a fingerprint or face). Two-factor authentication combines two of these. Two passwords would not count, since both are the same kind of factor.
Why it matters
Passwords fail in a lot of ordinary ways. They get reused across services and exposed in data breaches. They are typed into fake pages. They get guessed, especially if they are short or predictable. Once an attacker has a working password, an account without a second step is open to them from anywhere in the world.
With a second step in place, the stolen password alone does not complete the sign-in. The attacker would also need your phone, your security key or your code, which is usually much harder to obtain remotely. This turns a single point of failure into two, and is a clear example of the layered approach described in the cyber safety basics guide.
Common types of second factor
Codes sent by text message. A short code arrives on your phone. This is easy to set up and widely supported, and it is much better than no second factor. Its weaknesses are that texts can be intercepted in some circumstances, and attackers sometimes persuade a phone company to move a number to a different SIM, an issue known as SIM swapping. It is still a sensible default if nothing better is offered.
Authenticator apps. An app on your phone generates a code that changes every short period. It does not depend on your phone number or network, so it avoids some of the text message problems. If you lose the phone, though, you need a way to recover, so setup should include saving backup information.
Prompts on a trusted device. Some services send a notification asking you to approve or deny a sign-in. This is convenient, but people can approve a request out of habit or annoyance. If you receive an approval request you did not trigger, deny it and change your password.
Hardware security keys. A small physical device that you plug in or tap. These are generally regarded as among the strongest options, partly because they check that you are on the genuine site, which makes them resistant to many phishing scams. They cost money and can be lost, so having a spare is wise.
Passkeys and biometrics. Passkeys replace the password with a cryptographic credential held on your device and unlocked with a fingerprint, face or device PIN. Biometric authentication is used here to unlock the credential locally. These can combine convenience and strong protection, though support and recovery options vary between services.
What it does not do
Two-factor authentication substantially lowers risk but does not eliminate it, and it helps to know where it can still fail.
- Real-time phishing. A fake page can ask for your password and your code and pass them straight to the real site while you are still entering them. Methods tied to the genuine site, such as security keys and passkeys, resist this better than typed codes.
- Being talked into sharing a code. A caller or message claiming to be from your bank or a service asks you to read out a code. A legitimate organization should not need you to do this. Treat any such request as a warning sign.
- Compromised devices. If malware controls your phone or computer, some second factors can be defeated. Keeping software up to date helps reduce this risk.
- Weak recovery paths. If an account can be reset by answering easily found questions, the second factor can be bypassed. Recovery options deserve as much attention as the sign-in itself.
Setting it up sensibly
Start with the accounts that would hurt most to lose: your main email, banking, and anything that can reset other accounts. Email is especially important because reset links are typically sent there.
When you enable 2FA, most services offer backup codes. Store them safely, ideally in a password manager or a printed copy kept somewhere secure, and not only on the phone that generates your codes. If you change phones, move your authenticator setup before wiping the old one. Where possible, register more than one second factor, so that losing one device does not lock you out.
Choose the strongest method each service supports that you will realistically use. A somewhat weaker method that you actually enable beats a stronger one you never set up.
The trade-off
The cost is a few extra seconds at sign-in and a bit of planning for lost devices. For most people, that is a small price. As with most security measures, there is no promise of complete safety, but adding a second step meaningfully reduces the chance that a single leaked password becomes a stolen account. It also pairs well with other habits, such as using unique passwords and being careful about where you enter them.