What is 2FA?

Two-factor authentication (2FA) is a security mechanism that adds a second layer of verification beyond a password. It belongs to the broader category of multi-factor authentication (MFA). The core idea is to combine two different factors from three categories: something you know (a password), something you have (a phone or hardware token), or something you are (a fingerprint or other biometric). By requiring two distinct factors, 2FA dramatically reduces the risk of account takeover from stolen or guessed passwords.

The most common implementation uses a time-based one-time password (TOTP), defined in RFC 6238. A shared secret is stored on the user's device (e.g., in an authenticator app like Google Authenticator or Authy) and on the server. Every 30 seconds, the app generates a six-digit code based on the current time and the secret. The user enters this code after their password. Another popular form uses hardware security keys, such as those compliant with FIDO U2F or WebAuthn standards. These keys perform a cryptographic challenge-response and are resistant to phishing because the key verifies the domain before signing. SMS-based codes are also widely used but are considered less secure due to risks like SIM swapping.

In the wider security stack, 2FA is a critical control for protecting user accounts, especially for email, financial services, and corporate systems. It is often mandated by compliance frameworks (e.g., PCI DSS, NIST SP 800-63B). While not foolproof, 2FA raises the bar for attackers significantly. Modern implementations increasingly favor phishing-resistant methods like WebAuthn over SMS or TOTP. 2FA is also a foundational element of zero-trust architectures, where every access request is treated as potentially hostile and must be verified with multiple factors.