Two-Factor Authentication (2FA): Definition & explanation

With 2FA, a password alone is no longer enough to log in. After entering the password (factor 1: knowledge), the service requires a second, independent proof (factor 2: possession or biometrics). Common second factors include an SMS code, a one-time code from an authenticator app, a push confirmation on the smartphone, or a biometric trait like a fingerprint. The key is independence: an attacker who only knows the password gets nowhere without the second element. Many services offer 2FA optionally, while some now require it, such as banking apps or sensitive cloud accounts. Modern variants like passkeys replace the classic password-plus-code model with cryptographic keys bound directly to the device, largely eliminating phishing risk. 2FA mainly protects against credential stuffing, data leaks, and phishing attacks where login credentials end up in the wrong hands. Setup usually happens once in the account settings, after which the second factor is confirmed at every new login or new device.