2FA — two-factor authentication — means proving your identity with two different kinds of evidence instead of just a password. Typically that’s something you know (your password) plus something you have (a code from your phone) or something you are (your fingerprint). Even if an attacker steals your password, 2FA stops them getting in without that second factor — which is why it’s one of the single most effective security steps you can take.
Reviewed and kept current by the Coppers.io editorial team — see how we research .
What “two factors” actually means
Authentication factors come in three categories:
- Something you know — a password, PIN, or passphrase.
- Something you have — your phone, an authenticator app, or a hardware security key.
- Something you are — a fingerprint, face, or other biometric.
Two-factor authentication simply requires two of these different categories. A password plus a second password isn’t 2FA (both are “something you know”); a password plus a code from your phone is. When you use more than two, it’s called multi-factor authentication (MFA) — but for everyday accounts, 2FA is the term you’ll see.
Why 2FA matters so much
Passwords get stolen constantly — through breaches, phishing , and reuse. 2FA breaks the attack: a stolen password alone is no longer enough. The US Cybersecurity and Infrastructure Security Agency (CISA ) calls multi-factor authentication one of the most important things you can do to protect your accounts, and NIST’s 800-63B guidance recommends it for anything sensitive. It’s the natural partner to a strong, unique password .
The types of 2FA — from weakest to strongest
| 2FA method | How it works | Strength |
|---|---|---|
| SMS / email codes | A one-time code texted or emailed to you | Weakest — interceptable, SIM-swap risk |
| Authenticator app | A rotating code generated on your device (TOTP) | Strong — works offline, nothing sent to intercept |
| Push notification | Approve a prompt in an app | Strong — but beware “approval fatigue” attacks |
| Hardware security key | A physical USB/NFC key you tap | Very strong — phishing-resistant |
| Passkey / biometric | Device-bound cryptographic login | Strongest — replaces the password entirely |
Why an app or passkey beats SMS
SMS 2FA is far better than nothing, but it’s the weakest option for a reason: text messages can be intercepted, and SIM-swapping — where an attacker convinces your carrier to move your number to their device — hands them your codes. Phishing kits can also relay an SMS code in real time.
A 2FA app (an authenticator that generates rotating codes on your device) avoids all of that: the codes never travel over the network, and they work even with no signal. Stronger still are hardware keys and passkeys , which are phishing-resistant — they’re cryptographically tied to the real website, so they simply won’t authenticate on a fake one. If your account offers a choice, pick an app or passkey over SMS.
How to set up 2FA
- Open your account’s security settings (look for “Two-factor authentication,” “2FA,” or “Login verification”).
- Choose the strongest method offered — passkey or authenticator app ahead of SMS.
- For an authenticator app, scan the QR code to link it; the app then shows a rotating 6-digit code.
- Save your backup/recovery codes somewhere safe — ideally in your password manager . These get you in if you lose your device.
- Prioritise your most important accounts first: email, banking, password manager, and primary social and cloud accounts.
A note on recovery: losing your second factor with no backup can lock you out, so always store those recovery codes before you need them.
2FA, passwords, and passkeys
2FA bolts a second factor onto your existing password. Passkeys go further — they’re inherently multi-factor (your device plus your biometric) and replace the password altogether, which is why they’re the endpoint of this whole journey. Until passkeys are everywhere, the best setup is a strong unique password plus app-based or hardware 2FA. See passkeys vs. passwords for where each fits.
The bottom line
2FA means logging in with two different kinds of proof, so a stolen password isn’t enough to break in. Turn it on for every account that offers it, choose an authenticator app or passkey over SMS where you can, and save your recovery codes. It’s a five-minute change that blocks the large majority of account takeovers.
FAQs
- 2FA, or two-factor authentication, requires two different types of proof to log in — usually your password plus a code from your phone or a fingerprint. It means a stolen password alone can't unlock your account, which dramatically improves security.
- Yes. SMS codes can be intercepted or stolen through SIM-swapping, while an authenticator app generates codes on your device that never travel over the network and work offline. Hardware keys and passkeys are stronger still because they resist phishing.
- You use the backup or recovery codes you saved when setting up 2FA, or a second registered method, to regain access. This is why you should store recovery codes safely — ideally in a password manager — before you ever need them.
- 2FA is a form of multi-factor authentication that uses exactly two factors. MFA is the broader term for using two or more. For everyday accounts they're often used interchangeably, but MFA can include three or more factors for higher-security environments.
- Absolutely. 2FA is a second layer, not a replacement for the first. A weak or reused password still puts you at risk, so pair 2FA with a strong, unique password stored in a password manager for the best protection.