Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is a login method that requires proving identity with two independent factors instead of a password alone. It usually combines something the user knows (a password) with something they have (a phone, a hardware key) or something they are (a fingerprint). As a result, even a leaked password is not enough to take over an account — the attacker still needs the second factor.

How 2FA works

After a correct password, the system asks for a second proof of identity. The most common methods are:

• TOTP codes — one-time codes generated by an authenticator app under the TOTP standard, rotating every 30 seconds;
• SMS codes — sent to a phone; convenient but the least secure;
• push notifications — confirming a login with one tap in an app;
• hardware security keys and passkeys — based on WebAuthn and resistant to phishing.

The second factor is verified server-side, which effectively neutralises attacks based on stolen passwords.

Practical applications

2FA is now standard protection for bank accounts, email, website admin panels and corporate systems. It greatly reduces the impact of brute-force attacks and password database leaks, because a password alone stops being enough. Enabling 2FA is especially important for hosting access, server management panels and privileged administrator accounts, where a compromise has the most serious consequences. When rolling out 2FA, provide backup codes or an alternative recovery method so that losing a phone does not lock a user out for good. Keep in mind that methods vary in strength — SMS codes are weaker than TOTP apps, which in turn are weaker than phishing-resistant hardware keys. As a best practice, enable 2FA everywhere it is offered and treat it as a baseline security layer rather than an optional extra.