What Two-factor authentication (2FA) means
2FA is the most common form of multi-factor authentication. It is one of the highest-value, lowest-cost security steps a business can take. Store backup codes safely so you are not locked out if you lose your phone.
Why it matters for your website
Stolen or reused passwords are a common way websites, email and domain accounts get taken over. Adding a second factor means a leaked password alone is not enough, which blocks a large share of account takeover attempts.
Example
A hypothetical bakery owner's email password leaks in a breach, but the attacker cannot log in because they do not have the code from her authenticator app.
Tips
- Turn on 2FA first for email, domain registrar, hosting and banking accounts.
- Prefer an authenticator app or security key over text messages.
- Save backup codes somewhere safe and offline.
Common mistakes
- Approving a login prompt on your phone that you did not start.
- Losing your phone with no backup codes and getting locked out.
Questions about Two-factor authentication (2FA)
What is Two-factor authentication (2FA)?
A form of MFA that uses exactly two factors, usually a password plus a code or prompt.
Is 2FA the same as MFA?
2FA is a type of multi-factor authentication that uses exactly two factors. MFA can mean two or more.
Is text message 2FA safe?
It is much better than a password alone, but codes sent by text can be intercepted, for example through SIM swapping. Authenticator apps, passkeys and security keys are stronger options.
