Two-factor authentication (2FA) is a security method that requires exactly two independent factors from different categories to verify a user’s identity, most commonly something you know plus something you have. It’s the most familiar form of multi-factor authentication and, for most consumer services, the practical baseline for protecting an account.

2FA is a subset of MFA: all 2FA is MFA, but MFA can involve more than two factors. The distinction rarely matters in practice; what matters is that the two factors are independent.

How 2FA works

A typical flow pairs a password (something you know) with a second factor (something you have): a code from an authenticator app, an SMS message, a push approval, or a passkey. Because the two factors come from different categories, an attacker who steals the password still can’t log in without the second, which defeats the most common attack, credential replay from a breach.

Common 2FA methods, weakest to strongest

• SMS codes, widely used and better than a password alone, but exposed to SIM swapping and interception.
• Authenticator-app TOTP, codes generated on-device, stronger than SMS but still phishable in real time.
• Push notifications, a tap to approve; convenient but vulnerable to fatigue attacks.
• Passkeys / hardware keys, phishing-resistant and the strongest option, using cryptographic proof rather than a shareable code.

The limits of 2FA

2FA dramatically reduces account takeover, but it’s not immune. If the second factor is phishable (a code the user can be tricked into entering on a fake site) a real-time phishing attack can defeat it. This is why the strongest 2FA uses phishing-resistant factors, and why passwordless approaches, which can combine possession and inherence without any shared secret, are becoming the preferred path rather than bolting a second factor onto a password.

Choosing a strong second factor

If you’re implementing 2FA, the choice of second factor matters more than the fact that you have one. A rough ordering, weakest to strongest: SMS OTP (convenient, but SIM-swappable and phishable), then authenticator-app TOTP (no delivery channel to intercept, still phishable), then push with number matching (better, resists blind approvals), and finally passkeys or hardware security keys (phishing-resistant, no shared secret). For low-risk consumer accounts, TOTP or number-matched push is a reasonable baseline; for banking, payments, or admin access, phishing-resistant factors are the right target. The practical move for most teams is to offer a strong default while planning the path to passwordless, so 2FA becomes a stepping stone rather than a permanent destination.

Frequently asked questions

What’s the difference between 2FA and MFA?

2FA uses exactly two factors; MFA uses two or more. 2FA is a type of MFA.

Is SMS 2FA safe?

It’s better than a password alone but vulnerable to SIM swapping and phishing; stronger factors are preferable for high-value accounts.

What is the strongest form of 2FA?

Passkeys or hardware security keys, which are phishing-resistant.

Is 2FA enough on its own?

It sharply reduces account takeover, but phishable second factors can still be defeated by real-time phishing, which is why phishing-resistant or passwordless methods are the stronger goal.

Does 2FA hurt the user experience?

It adds a step, which is why risk-based approaches apply it selectively and why passwordless methods aim to deliver strong security without the extra friction.

Related: Multi-Factor Authentication (MFA) · SMS OTP / SMS 2FA · Passkeys · Time-Based OTP (TOTP) · Strong Customer Authentication (SCA)