Password security guide
Two-Factor Authentication (2FA): How It Works and Which Method to Use
Two-factor authentication adds another proof of identity after a password. The method matters: security keys and passkeys resist phishing better than manually entered codes.
What 2FA and MFA mean
Authentication proves that a person or device controls an account credential. Two-factor authentication, or 2FA, requires evidence from two different factor categories. Multifactor authentication, or MFA, is the broader term for two or more factors. Two passwords do not make 2FA because both are knowledge factors.
Services sometimes use “two-step verification” for a second login step that may or may not be a distinct factor under a formal standard. For ordinary users, the practical question is which authenticators the service offers and which attacks each method can resist.
The authentication factors
| Factor | Examples | Main risk |
|---|---|---|
| Something you know | Password, account PIN | Guessing, reuse, phishing or disclosure |
| Something you have | Phone, authenticator app, hardware security key | Theft, loss, insecure recovery or malicious approval |
| Something you are | Fingerprint or face used locally to unlock an authenticator | Device compromise, false match and recovery design |
A biometric often unlocks a device-held credential. The website normally receives cryptographic proof, not a copy of the fingerprint or face image.
Why 2FA helps after password theft
A reused, phished or breached password may let an attacker pass the first login check. A second independent authenticator can stop that login when the attacker does not control the enrolled device or key. It also gives the service a chance to warn the user about an unexpected attempt.
2FA does not repair password reuse, malware or weak recovery. Attackers may phish a one-time code in real time, trick a user into approving a prompt, steal a session after login, or persuade support to reset the account. Use a unique password and protect every recovery route.
Authenticator apps and one-time codes
An authenticator app commonly creates time-based one-time passwords. The code changes at a fixed interval and works without mobile service. It is generally a better default than SMS because it does not depend on the phone network or number ownership.
Manually entered codes are not phishing-resistant. A convincing fake site can relay a current code to the real service. Enroll the app from the legitimate account settings, protect device backups, and do not photograph or casually synchronize the setup secret. Keep a separate recovery method before moving to a new phone.
Hardware security keys
A FIDO security key uses public-key cryptography and verifies the website identity before producing an authentication response. Proper WebAuthn and FIDO flows bind the credential to the legitimate relying party, so a lookalike domain cannot obtain a valid response for the real site.
Security keys are a strong choice for email, password managers, administration and other high-value accounts. Register at least two keys when the service supports it. Store the spare separately, name the keys in account settings, and remove a lost key promptly.
Push authentication and fatigue attacks
Push authentication asks an enrolled device to approve a sign-in. A clear number-matching or transaction-confirmation flow is safer than a simple approve button. Repeated unexpected prompts can be an authentication-fatigue attack intended to produce an accidental approval.
Deny requests you did not initiate. Then change a compromised password, review account activity and report the event. Never approve a prompt because a caller claims to be support.
SMS verification and its limitations
SMS can be better than password-only access when stronger options are unavailable. Its weaknesses include number porting or SIM-swap fraud, message interception, phone account recovery, unreliable coverage and phishing of the code. NIST treats public telephone network out-of-band authentication as a restricted authenticator and requires an alternative in covered systems.
Do not disable SMS and leave an important account without a tested replacement. First enroll an authenticator app, passkey or security key, verify recovery, and only then remove the weaker method when the service permits it.
Backup codes and recovery planning
Backup codes are emergency credentials. Each code can often bypass the normal second factor once, so store them like passwords. Keep them offline or in a protected vault, separate from the only device that holds the authenticator. Replace the set after use or suspected exposure.
Record which accounts depend on a phone number, device, credential provider or hardware key. Test a backup method before travel, device replacement or closing a phone number. For shared or business accounts, use named users and documented administrative recovery instead of a shared code sheet.
Phishing-resistant authentication
Phishing resistance means the protocol prevents a credential or valid authenticator output from being disclosed to an impostor verifier without depending on the user spotting the fraud. NIST states that passwords and manually entered one-time codes are not phishing-resistant. WebAuthn credentials can provide phishing resistance through verifier-name binding.
Prefer a passkey or FIDO security key when available, especially for primary email, financial access, password managers and administrator accounts. Keep devices updated and review account recovery because a strong daily login can still be bypassed by a weak reset process.
Passwords, passkeys and MFA
A password plus a distinct authenticator can form MFA. A passkey may itself be a multifactor cryptographic authenticator when possession of the credential is combined with local user verification such as a device PIN or biometric. The exact assurance depends on how the credential, device and service are configured.
Some services use a passkey as the complete sign-in. Others retain a password or another recovery route. Test access on a second authorized device before removing an old method. Read Password vs Passkey for storage, synchronization and recovery tradeoffs.
Practical method order
- Use a passkey or FIDO security key where the service supports it and recovery is understood.
- Use an authenticator app when phishing-resistant authentication is unavailable.
- Use well-designed push verification with number matching and careful prompt review.
- Use SMS when it is the only practical second factor, while protecting the mobile account and planning a stronger replacement.
- Save fresh backup codes and test a second safe recovery route.
The strongest unusable setup can create lockout. Choose the strongest method you can operate reliably, then improve it deliberately.
Limitations and response checklist
MFA cannot stop every attack. An attacker may control an unlocked device, steal a browser session, exploit account recovery, abuse connected applications or compromise the service. Do not treat an MFA badge as proof that a login page is genuine.
- Open account settings through a trusted address.
- Use a unique stored password if a password remains.
- Enroll two safe authenticators for important accounts.
- Remove old phones, keys and sessions.
- Investigate every unexpected prompt.
- Protect email and the credential-provider account.