Tech Explained Tuesday 009: What Is Two-Factor Authentication—and Why Isn’t a Password Enough?

Quick answer

Two-factor authentication, or 2FA, requires two different kinds of proof before an account lets you in. A password is only one kind of proof: something you know. Adding something you have, such as a security key or a device with an authenticator, creates a second barrier. If someone steals your password but cannot provide that second factor, the login may still be blocked.

That is why a strong password still matters—but is not enough on its own for important accounts.

What is two-factor authentication?

Two-factor authentication is a form of multifactor authentication that uses two distinct authentication factors. The three common factor categories are:

• Something you know, such as a password or PIN

• Something you have, such as a phone, authenticator, or physical security key

• Something you are, such as a fingerprint or another biometric characteristic

The word “distinct” matters. A password followed by a PIN is still two knowledge-based checks, so it is not true two-factor authentication under the National Institute of Standards and Technology definition. Combining a password with possession of a registered device, for example, uses two different factors.

Why isn’t a password enough?

A password can be long and unique and still be exposed. Someone may capture it through a phishing page, steal it with malicious software, obtain it from a compromised service, or discover that it was reused on another account.

Once an attacker has a working password, a password-only login has no independent way to determine whether the person signing in is you or the person who stole the secret. The account sees the correct password and may grant access.

Two-factor authentication changes that decision. The password can satisfy the first checkpoint, while the second checkpoint asks for a different form of evidence. The second factor does not make account takeover impossible, but it reduces the value of a stolen password by itself.

How does 2FA work during a login?

A typical login follows four steps:

1. You enter your username and password.

2. The service verifies the password.

3. The service asks for a second factor, such as a security-key response or a code generated by an authenticator.

4. Access is granted only after the required checks succeed.

Some devices combine the experience. For example, a device may hold a cryptographic key and require your fingerprint or local PIN before it can use that key. The screen may show one simple prompt even though more than one factor is involved behind the scenes.

What kinds of 2FA can you use?

Physical security keys

A security key is a device that you plug in, tap, or bring near your computer or phone. Properly implemented phishing-resistant security keys can verify the real service rather than handing a reusable code to a fake login page. They are a strong choice for email, administrative accounts, financial access, and other high-impact accounts when supported.

Authenticator apps

An authenticator app may generate a time-limited code or approve a sign-in prompt. Codes from an authenticator app do not depend on cellular text delivery. Number-matching prompts can also make accidental approvals less likely because you must match information shown during the login.

Text-message or email codes

A code delivered by text or email can add a barrier beyond a password, but it is generally a weaker option than phishing-resistant methods. Text messages may be exposed through phone-number takeover or interception, while an email-delivered code depends on the security of the email account receiving it. Use these options when they are the strongest methods the account provides, then upgrade if a stronger option becomes available.

Biometrics

A fingerprint or face check can be part of multifactor authentication, usually in combination with a device you possess. The biometric often unlocks an authenticator stored on that device. It is important to understand the entire login design rather than assuming that every fingerprint prompt works the same way.

Which 2FA method should you choose?

Use the strongest method an account supports and that you can reliably maintain.

For important accounts, prefer phishing-resistant authentication such as a supported security key or another properly implemented phishing-resistant authenticator. If that is unavailable, an authenticator app is generally preferable to a code sent by text or email. A text or email code is still useful when the only alternative is password-only access.

Your choice should also account for recovery. A strong method that leaves you permanently locked out after losing one device is not a complete setup. Register a backup authenticator or security key when the service permits it, and store recovery codes somewhere protected and separate from the device you normally use.

Where should you enable 2FA first?

Begin with accounts that can unlock other accounts or expose sensitive information:

• Primary email, because password-reset messages often arrive there

• Banking and payment accounts

• Cloud storage and document-sharing accounts

• Social media accounts

• Password-manager accounts

• Apple, Google, or Microsoft accounts tied to devices and services

• Administrator, remote-access, and business-management accounts

For a household or small business, email and administrator accounts are especially important starting points because one compromised account may provide access to many connected systems.

How to turn on 2FA safely

1. Sign in by navigating directly to the service or using its official app. Avoid enabling security features through an unexpected email link.

2. Open the account’s Security, Sign-in, or Login settings.

3. Look for Two-Factor Authentication, Two-Step Verification, or Multifactor Authentication.

4. Review the available methods and choose the strongest practical option.

5. Register the authenticator and complete a test login before signing out everywhere.

6. Add a backup method if the service supports one.

7. Save recovery codes in a secure place that is separate from your usual device.

8. Review trusted devices and remove anything you no longer recognize or use.

What should you do with unexpected approval prompts?

Do not approve a sign-in request you did not initiate. An unexpected prompt may mean that someone has your password and is trying to get past the second factor. Deny the request, change the password by going directly to the service, review recent account activity, and sign out unfamiliar sessions. If the account offers number matching or a phishing-resistant method, consider upgrading.

Does 2FA replace a strong password?

No. A unique password and a second factor protect against different failures. A strong, unique password reduces guessing and reuse risk. The second factor adds another requirement if that password is exposed. Use both, and keep the account’s recovery information current.

Frequently asked questions

Is 2FA the same as MFA?

2FA is a type of multifactor authentication that uses two distinct factors. MFA is the broader term for authentication that requires more than one distinct factor.

Are two passwords considered two-factor authentication?

No. Two passwords are both “something you know.” NIST guidance says multiple instances of the same factor remain single-factor authentication.

Can 2FA be hacked?

No security control prevents every attack. Some codes can be phished, approval prompts can be abused, devices can be compromised, and account-recovery processes can be targeted. Stronger, phishing-resistant methods reduce important risks, but users should still watch for unexpected prompts and suspicious account activity.

Is text-message 2FA better than no 2FA?

Yes, when the only alternative is a password alone, a texted code adds another barrier. However, CISA recommends moving to stronger methods when they are available because text and email codes provide weaker protection than security keys and well-configured authenticator options.

What happens if I lose my phone or security key?

Use a previously registered backup authenticator, backup key, or recovery code. If none is available, follow the service’s official account-recovery process. Set up recovery options before an emergency and never share a one-time code or recovery code with someone who contacts you unexpectedly.

The bottom line

A password answers one question: does this person know the secret? Two-factor authentication asks for a second, different kind of proof. That extra checkpoint means a stolen password alone may not be enough to open the account.

Turn on 2FA for your most important accounts, choose the strongest option each service supports, keep a protected backup method, and treat unexpected approval prompts as a warning.

Authoritative guidance

National Institute of Standards and Technology, Multi-Factor Authentication Glossary: https://csrc.nist.gov/glossary/term/Multi_Factor_Authentication

NIST Digital Identity Guidelines, Digital Identity Model: https://pages.nist.gov/800-63-4/sp800-63/model/

Cybersecurity and Infrastructure Security Agency, Require Multifactor Authentication: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication

NEXT WEEK: What Is a Password Manager—and Is It Safe to Use One?