Two-factor authentication adds a second category of evidence to help confirm that someone signing into an account is authorised. Instead of relying only on a password, a service can ask for proof from a trusted device or another appropriate factor.
Not every login with two steps uses two different factors. A password followed by another memorised secret remains knowledge-based authentication. Authenticator apps, hardware security keys and passkeys use different methods and offer different levels of resistance to phishing.
Quick summary: passwords are knowledge factors; devices can provide possession factors; biometrics can help unlock credentials; OTP codes are temporary; security keys use cryptography; and account recovery must be protected.
The three factor categories
Authentication factors are commonly described as something you know, something you have and something you are.
A password is knowledge, a hardware security key is possession, and a biometric characteristic may be an inherence factor. Two passwords do not constitute two different categories.
How authenticator codes work
Many authenticator apps generate time-based one-time passwords from a shared secret and the current time.
The service calculates the expected code and compares it with the submitted one. Codes can still be stolen through phishing during their validity period.
How SMS codes work
A service sends a temporary code to a registered phone number. The user enters it to complete a login.
SMS adds protection in many circumstances but is vulnerable to phone-number takeover, interception and phishing. Stronger methods may be preferable for sensitive accounts.
How hardware security keys work
A compatible security key uses cryptographic challenge-response methods. The private key remains protected by the authenticator.
Origin binding can prevent a fake website from using the same response as the legitimate service. Protection depends on the actual protocol and configuration.
How passkeys work
Passkeys commonly use public-key cryptography. A protected private key signs a challenge, and the website verifies the signature using the corresponding public key.
Passkeys reduce reliance on reusable passwords and can resist many phishing attacks. Device recovery and credential syncing still require planning.
Why push approvals can be risky
Some services ask a trusted device to approve a sign-in. Attackers may repeatedly send requests or persuade someone to approve one.
Never approve a login you did not initiate. Number matching can help but does not remove the need to verify the request.
Why OTP codes are not phishing-proof
A fraudulent website can ask for your password and a temporary code, then attempt to use both at the legitimate service.
Do not read codes to callers or enter them on unfamiliar pages. Prefer phishing-resistant authentication when supported.
Why recovery codes matter
Recovery codes provide a backup path when a device or normal factor is lost. They may be single-use secrets.
Store them securely and separately from the device they are intended to replace. Never share them with someone claiming to be support staff.
What happens when a phone is lost
A person may lose access to an authenticator app, SMS number or device-bound credential. The service’s recovery process determines how access can be restored.
Configure backup authenticators and recovery methods before an emergency. Review signed-in devices and revoke access to lost equipment where appropriate.
Why email needs strong protection
Email accounts often receive password-reset messages and security notifications. Someone controlling your email may be able to influence recovery for other accounts.
Use unique credentials and strong MFA on your main email account. Check recovery contacts and remove unfamiliar sessions.
Two-factor authentication and password managers
A password manager can generate and store unique credentials, while a separate authentication factor adds another safeguard.
Some managers also store OTP secrets or passkeys. Consider the convenience and the risk of concentrating several controls in one vault.
Setting up a new factor
Open the service’s official security settings, choose an available method and follow its setup instructions. Confirm that it works before signing out everywhere.
Avoid enrolling through links from unexpected messages. Record recovery options and keep a second trusted method where the service permits it.
Common troubleshooting
A time-based code may fail if the device clock is inaccurate, the wrong account entry is selected or the code has expired.
Check the official app and device settings. Do not disable MFA permanently just to avoid a temporary setup problem.
Frequently asked questions
Is an SMS code better than no second factor? It can improve security, though stronger options exist. Are passkeys passwords? They generally use cryptographic keys rather than a shared reusable password.
Can someone steal an OTP? Yes, through phishing or compromise. Does biometric unlock mean the website receives my fingerprint? Not ordinarily in well-designed passkey systems.
The mental model
Follow the chain: account identity → credential → additional factor or cryptographic proof → service verification → account access.
Good authentication combines appropriate methods with secure recovery. The best second factor is one you can use consistently without approving fraudulent requests.