Passwords have a problem: people reuse them, they leak in data breaches, and they can be phished. Two-factor authentication (2FA), also called multi-factor authentication (MFA), fixes the single point of failure by asking for a second proof that you are who you claim to be. Even if a thief steals your password, they still cannot get in without the second factor. Here is how it works, which methods are strongest, and how to set it up properly.
The core idea: two proofs, not one
Logging in with a password asks one question: do you know the secret? Two-factor authentication asks a second, independent one. Security experts group these proofs into three factors:
- Something you know — your password or PIN
- Something you have — your phone, a security key, or an authenticator app
- Something you are — your fingerprint or face
2FA usually combines a password (something you know) with a code or approval from a device (something you have). The protection is real: Microsoft's research found that MFA reduces the risk of account compromise by over 99%. A 2019 study by Google, NYU, and UC San Diego measured exactly how well different second factors blocked real attacks: SMS codes stopped 100% of automated bots, 96% of bulk phishing attempts, and 76% of targeted attacks — while hardware security keys stopped all three categories completely.
The main methods, ranked
Not all second factors are equal. Here is how they compare, from weakest to strongest:
- SMS codes — a text message with a one-time code. Better than nothing, but vulnerable to SIM swapping, where a scammer convinces your mobile carrier to hand your number to a new SIM and then receives your codes. The FBI logged 982 SIM-swap complaints in 2024, with losses of nearly $26 million. Text messages can also be intercepted. The US standards body NIST has downgraded SMS for high-assurance use.
- Authenticator apps — apps like Google Authenticator or Microsoft Authenticator that show a six-digit code changing every 30 seconds. The code is generated on your device, so nothing travels over the phone network — a SIM swap gets an attacker your number and nothing else.
- Push approvals / number matching — your phone asks "Approve this login?" Attackers can spam prompts hoping you tap approve by accident (push bombing); number matching (typing a number shown on the login screen) largely fixes that.
- Hardware security keys and passkeys — physical keys (like a YubiKey) or passkeys built into your phone that cryptographically prove you are on the real website. Because they are phishing-proof — a fake site cannot complete the handshake — they are the gold standard.
| Method | Blocks SIM swap? | Blocks phishing? | Effort to set up |
|---|---|---|---|
| SMS code | No | Partly | Very low |
| Authenticator app | Yes | Partly | Low |
| Push approval | Yes | Partly | Low |
| Security key / passkey | Yes | Yes | Medium |
How authenticator apps actually generate codes
This is the bit that surprises people: the app works offline. When you set up 2FA, the service gives your app a secret key — usually delivered as a QR code you scan. From then on, both your phone and the server independently run the same calculation: they combine the shared secret with the current time, divided into 30-second windows, using a hashing algorithm called HMAC-SHA1. That produces the same six-digit code on both sides. The algorithm is an open standard called TOTP (Time-based One-Time Password, RFC 6238), which is why Google Authenticator, Authy, 1Password, and Apple's built-in passwords app all show the same code for the same account.
Because the code changes every 30 seconds, a stolen code is useless almost immediately. If the code fails while you know it is right, it usually means your phone's clock is slightly off — enabling automatic time in your settings fixes it.
Why SMS is the weakest link
Text-message codes were the first popular form of 2FA, and they are still better than a password alone. But SMS was built in the 1980s on trust assumptions that no longer hold: anyone who controls your phone number can receive your messages. SIM swapping exploits exactly that — attackers social-engineer carrier staff into porting your number. Reported US losses peaked at around $72.6 million in 2022. If a service offers an authenticator app or passkey option, always prefer it over SMS. And ask your carrier to add a port-out PIN to your account.
Where 2FA still has gaps
Honesty matters: 2FA is a strong floor, not an impenetrable wall.
- Real-time phishing can capture even authenticator codes if you type them into a convincing fake login page — which is why passkeys, which never touch a fake site, are the stronger answer.
- Recovery paths are the quiet weak spot. If an attacker can reset your password by answering "security questions" or via an old email account, the second factor never gets a say. Secure your recovery email with 2FA too.
- Device loss locks you out if your codes live on one phone. Always save backup/recovery codes when a service shows them — print them and keep them somewhere safe.
How to set it up in five minutes
- Turn it on for your email account first — email is the key to resetting everything else.
- Prefer an authenticator app (or passkey where offered) over SMS codes.
- Save the backup codes the service shows you; store them offline, not as a screenshot on the same phone.
- Turn it on next for your bank, social media, and cloud storage — the accounts where a takeover hurts most.
- Add a port-out PIN with your mobile carrier if you use any SMS-based codes.
For more on phishing tricks and general account safety, see our cybersecurity basics guide and our explainer on what makes passkeys different.
Takeaway checklist
- 2FA combines a password (something you know) with a second proof (something you have), cutting compromise risk dramatically.
- Ranked weakest to strongest: SMS codes → authenticator apps → push approval → security keys/passkeys.
- Authenticator apps use TOTP: your phone and the server independently compute the same six-digit code every 30 seconds — fully offline.
- SMS is vulnerable to SIM swapping (982 FBI complaints, ~$26M losses in 2024); use app codes or passkeys where offered.
- Security keys and passkeys are phishing-proof — a fake site cannot complete their handshake.
- Watch the gaps: recovery options, clock skew, and device loss are where real accounts get taken over.
- Start with your email, save backup codes, and add a carrier port-out PIN.
