Two-factor authentication (2FA) is a security method that requires two different types of identity proof before granting access to an account, so a stolen password alone is not enough to get in.
2FA requires two proofs of identity from different categories: something you know such as a password, something you have such as a phone or a hardware security key, and something you are such as a fingerprint. Because the two proofs come from different categories, compromising one does not hand over the other.
After you enter your password as the first factor, the service asks for a second factor before signing you in. Common second factors are a code sent by text message, a time-based code from an authenticator app, a push notification you approve, or a hardware security key. Access is granted only when both factors check out.
Text-message codes are the most convenient but the weakest, because they can be intercepted through SIM swapping. Authenticator-app codes and hardware security keys are stronger, since they are not sent over the phone network and stay on your device.
They are often used interchangeably. Strictly, 2FA requires two factors from different categories, while two-step verification can use two proofs from the same category.
It is far better than no second factor, but it is weaker than app-based codes or a hardware key because text codes can be intercepted through SIM swapping.
Home · By Runze