Two-Factor Authentication (2FA)
In simple terms
Two-Factor Authentication is like having two locks on your front door instead of one. Even if someone steals your password (first lock), they still can't get into your account without a second piece of proof, like a code from your phone (second lock).
Definition
An extra layer of security requiring a second form of verification beyond your password.
In depth
Two-Factor Authentication implements a second verification factor beyond password-based authentication, typically employing time-based one-time passwords (TOTP), SMS codes, or hardware security keys. The system generates or transmits a unique, time-sensitive credential that must be presented alongside the initial credential within a specified window. This multi-factor approach mitigates risks from credential compromise, phishing, and brute-force attacks by requiring possession of a secondary device or knowledge factor that exists independently of the primary authentication mechanism.
How does Two-Factor Authentication (2FA) work?
Setting up an app-based second factor gives your phone and the server a shared secret, usually transferred by scanning a QR code. From then on both sides run the same algorithm over that secret plus the current 30-second time slot, producing a six-digit code that keeps changing. At login the server recomputes the expected code and compares. A hardware security key works differently: it stores a private key, signs a challenge from the site, and refuses to sign for a lookalike domain, which is why keys resist phishing. SMS codes travel over the phone network instead.
An example
Someone enables an authenticator app on an exchange account and saves the ten backup codes in a password manager. A phishing email later captures their password, but the attacker cannot log in without the rotating code. Months on, the phone is lost. One backup code restores access, and enrolling a replacement device triggers a 48-hour hold on withdrawals. The hold length is illustrative and varies by platform.
Figures are illustrative only.
What beginners get wrong
- Skipping the backup codes at setup is common, and a lost or wiped phone can then lock the account out entirely.
- SMS is the weakest widely offered option, because a SIM-swap attack moves the phone number to an attacker's device and delivers the codes there.
- A code typed into a page opened from an email link can be relayed to the real site within seconds; navigate to the site directly instead.
- Keeping the password and the authenticator behind one login means a single compromise supplies both factors at once.
Related terms
Part of
How do crypto wallets and self-custody work? — the subject page for wallets and self-custody, with all 13 of its definitions in one place.
Educational only — not financial advice.