What is two-factor authentication, and which type is safest?

Two-factor authentication, usually shortened to 2FA, is the practice of proving who you are twice, using two different kinds of evidence. A password alone is a single lock. Two-factor authentication adds a second one that an attacker has to defeat separately, so that knowing your password is no longer enough to get into your account.

The idea rests on a simple classification. Authentication factors fall into three categories: something you know, such as a password or a PIN; something you have, such as a phone, a code-generating app or a small hardware key; and something you are, such as a fingerprint or a face scan. Genuine two-factor authentication draws on two different categories. A password followed by a security question is not two-factor authentication, because both are things you know, and both can be learned by the same attacker in the same breach.

Why a password alone stopped being enough

Passwords fail in bulk. When a company is breached, the credentials taken are not used one at a time by hand; they are fed by the million into automated systems that try the same email and password against banks, retailers and mail providers, on the reasonable assumption that people reuse them. This is why a password you consider strong can still be worthless: its strength is irrelevant if it has already leaked somewhere else.

A second factor breaks that economics. An attacker working through a list of stolen credentials cannot also be holding your phone or your security key. The attack stops being something that scales automatically and becomes something that has to be aimed at you personally, which is far more expensive and far rarer.

The three common types, from weakest to strongest

Codes sent by SMS. The service texts you a short numeric code. This is the most widely offered form and the least secure, because the code travels through the phone network rather than to a specific device you control. In a SIM-swap attack, someone persuades a mobile operator to move your number to a SIM card they hold, after which your codes arrive on their handset. Security guidance has moved steadily away from SMS for this reason. It is still far better than no second factor at all.

Authenticator apps. An app on your phone generates a six-digit code that changes every thirty seconds, derived from a shared secret and the current time. Because the codes are produced on the device itself, there is no message to intercept and no operator to deceive. The remaining weakness is human: if a convincing fake login page asks for the code, most people will type it in, and the attacker can relay it to the real site within the thirty-second window.

Security keys and passkeys. A hardware security key is a small device that plugs in or taps against your phone. A passkey is the same cryptography stored on your phone or computer rather than a separate object. Both work by holding a private key that never leaves the device, and both check which website is asking before they respond.

What makes the strongest option different

That last detail is the one worth understanding, because it is the reason security keys and passkeys sit in a category of their own. They are bound to the website’s actual address. Present a passkey with a counterfeit login page at a lookalike domain and it will simply not produce a signature, because the domain does not match the one the credential was created for. The user does not have to notice the misspelling in the address bar; the check happens whether they are paying attention or not.

This is what the industry means by phishing-resistant authentication, and it is a genuine step change rather than a marginal improvement. Codes — whether texted or generated in an app — can always be repeated to someone else by a person who has been fooled. A cryptographic key bound to a domain cannot.

What to turn on, and where

The practical advice is unglamorous. Turn on the strongest second factor each service offers, and start with the accounts that can be used to reset the others: your email first, because whoever controls your inbox can request password resets everywhere else, then your password manager, then banking, then everything that holds money or personal data.

Keep recovery codes somewhere real. Most services issue a short list of one-time backup codes when you enable 2FA, and these are what stand between a lost phone and a permanently locked account. Printed and kept with your documents is a reasonable answer; a screenshot in the same phone you might lose is not. And if a service offers only SMS, enable it anyway. The best available second factor is the one worth having, and the meaningful gap is between one factor and two, not between one type of second factor and another.