What is Two-Factor Authentication?

Two-factor authentication means proving who you are in two different ways — like your password plus a code sent to your phone.

Think of it like this

It's like a bank vault that needs two different keys held by two different people — one key alone opens nothing. With 2FA, one "key" is something you know (your password) and the other is something you have (your phone). A thief would need to steal both to get in.

What's happening

Diagram showing two factors — a password you know and a code sent to a phone you have — combining to open a padlock, while a thief with only a stolen password is denied access

Summary

2FA adds a second lock to your accounts. Even if someone steals your password, they can't log in without the second factor — usually your phone.

A Closer Look

Security factors come in three flavours: something you know (a password or PIN), something you have (your phone, or a physical security key), and something you are (your fingerprint or face). Two-factor authentication just means combining any two different types — which is why a password plus a security question doesn't count, since both are things you know.

Not all second factors are equally strong. Codes sent by text message are better than nothing but can be intercepted. Authenticator apps that generate codes on your phone are stronger, and passkeys — a newer method using your device's fingerprint or face unlock — are stronger still and are slowly replacing passwords altogether.

Common Misconceptions

2FA doesn't mean your password no longer matters — a weak password still makes the first lock easy to pick; 2FA is a backup, not a replacement.
It isn't there to annoy you — that extra 10 seconds at login is the single most effective thing blocking account takeovers.
2FA is not unbreakable — scammers can trick you into reading your code out to them on the phone; no legitimate company will ever ask for it.

How it connects

2FA is one of the most visible pieces of everyday security:

🛡️ Cybersecurity — the bigger picture 2FA belongs to 🔒 HTTPS & Encryption — protects your login as it travels 🍪 Cookies — how sites remember you're logged in afterwards 🌍 Websites — where you meet 2FA prompts every day

Try it yourself

Open the security settings of your email account (search "two-factor" or "2-step verification" in settings) and switch it on. Your email is the account most worth protecting — it's the master key that can reset the passwords for everything else.