What two-factor authentication is and why it matters

Passwords have a structural problem: anything that knows the password is you, as far as the server can tell. If a password leaks in a breach, gets reused on a shady site, or is watched over your shoulder, the attacker gets the full account. Two-factor authentication, usually shortened to 2FA, fixes that by requiring a second proof that only you can produce.

This guide explains what that second factor actually is, how the six-digit codes most people know are generated, and what to look for when you pick an authenticator app. It is the first post in a series; the next ones go deeper into TOTP, HOTP, and zero-knowledge encryption.

The three factors

An authentication factor is one category of proof. There are exactly three that matter in practice:

• Something you know: a password, a PIN, a passphrase.
• Something you have: a phone, a hardware key, a smart card.
• Something you are: a fingerprint, face, or other biometric.

A password is a single factor. 2FA combines two different categories, most often your password plus a code generated by an app on your phone. The point is independence: stealing the password is no longer enough, because the attacker also needs the physical device or the secret seed inside it.

Two factors from the same category, like a password plus a security question, are not real 2FA. Both are things you know, and both leak in the same ways.

Why passwords alone fail

The math is unforgiving. A large share of people reuse the same password across sites, and breaches are constant. Attackers buy credential lists from old breaches and try them everywhere, a technique called credential stuffing. Weak passwords additionally fall to offline guessing at rates of billions of attempts per second on modern hardware.

Even strong, unique passwords leak. Server-side breaches happen to careful companies. When a password database is stolen, only the quality of the site's hashing slows the attacker down. Your account's safety ends up depending on someone else's engineering budget.

The second factor cuts this attack surface down. A leaked password is useless without the device. A phishing page that captures your password does not capture the rotating code, unless the phishing operation is sophisticated enough to relay codes in real time, which is a much rarer and more expensive attack.

How those six-digit codes work

Most authenticator apps use an open standard called TOTP, the Time-based One-Time Password algorithm, published as RFC 6238 by the Internet Engineering Task Force. You can read the specification at rfc-editor.org.

When you set up 2FA on a website, it gives your app a shared secret, usually shown as a QR code. The secret is a random string, typically encoded in base32. From that moment:

1. Your app and the server both hold the same secret.
2. Both compute a code from the secret plus the current time, in fixed 30-second windows.
3. You type the code; the server computes the same value and compares.

No code is ever transmitted in advance. Nothing is sent over the network during generation. The server verifies a code by recomputing it, which means the algorithm needs no connection on your side at all. That is why authenticator apps work in airplane mode.

The codes rotate every 30 seconds, and each code is single-use in practice. An attacker who saw one code has, at best, a few seconds to replay it, and replay is rejected once the window passes.

TOTP has a sibling called HOTP, the counter-based version from RFC 4226. HOTP advances a counter instead of using time; the next code appears only when you ask for it. Some services, and the Steam gaming platform with its five-character codes, use their own variants built on the same foundations. A good authenticator supports all of them.

What 2FA does not fix

Honesty about limits is part of security. 2FA raises the cost of attack dramatically, but it is not magic:

• Real-time phishing can relay both your password and the current code to the attacker's side instantly. Passkeys, hardware security keys, resist this; app codes do not.
• Malware on your device can read codes as they appear. No second factor survives full device compromise.
• Recovery channels are often the weakest link. If "forgot password" goes to an email account with no 2FA, the attacker walks through the side door.

None of this is an argument against 2FA. It is an argument for turning it on everywhere, then hardening email first, then considering hardware keys for the accounts that matter most.

Choosing an authenticator

Once you decide to use 2FA, you need something to hold the second factor. A few properties separate a good authenticator from a risky one:

• Open standards: TOTP and HOTP, so you are not locked to one vendor's protocol.
• No account required to generate codes: the tool should work for a guest with zero signup, zero storage, and zero network calls.
• Local encryption for stored secrets: if you keep codes in a vault, the server should hold ciphertext it cannot decrypt, so a full server compromise reveals nothing.
• Export and import: your second factor should be portable between apps, not held hostage.
• Offline operation: code generation is pure math and needs no network.

The US National Institute of Standards and Technology maintains the authentication guidance behind most of this; its Digital Identity Guidelines are the reference document at pages.nist.gov.

Where to start

Turn on 2FA for your email first, because email resets everything else. Then banking and payment services, then social accounts, then the rest. Most major services support authenticator apps under a name like "authenticator app" or "TOTP" in their security settings.

If you want to try the flow without committing to anything, the guest tool on our homepage generates live codes from a pasted secret, stores nothing, and sends nothing. When you want storage, our features page describes the encrypted vault, and pricing keeps a free tier that covers most personal use.

The strongest security decision you can make today costs about two minutes per account. Start with the one that guards everything else.

Frequently asked questions

Is 2FA the same as two-step verification?

Practically, yes. Services brand the feature as "two-step verification," "two-factor authentication," "multi-factor authentication," or just "2FA," and they all mean the family of methods in this article. Pedantically, some two-step setups use two copies of the same factor, like a password plus a code sent to an email that the same password protects. That is two steps of one factor. The authentication factors explained draws that line precisely.

What is the best second factor to use?

An authenticator app generating TOTP codes is the best balance for most people: no carrier in the loop, works offline, portable between apps, and resistant to everything except real-time phishing. A hardware security key is stronger still and cannot be phished at all, at the cost of buying hardware and carrying it. SMS is the weakest option worth having, and still far better than nothing.

Can 2FA be hacked?

The factor itself is rarely broken, because attackers go around it. Real-time phishing pages that relay your code, SIM swaps that steal SMS delivery, and malware on a fully compromised device all defeat 2FA in specific scenarios. None of that argues against using it, because every one of those attacks is dramatically harder than guessing a password. Can 2FA be bypassed? covers the attack surface honestly.

Do I need 2FA on every account?

Prioritize by blast radius: email first, because it can reset everything else, then banking and payment services, then accounts holding money or reputation such as gaming, crypto, and social. A low-stakes forum account with no payment details and a unique password can sit lower on the list. The two-minute cost per account makes the ordering matter less each year.

Does two-factor authentication cost money?

No. Every major service includes 2FA with the account itself, and good authenticator apps are free. The paid tier of our own product adds encrypted storage and sync for your codes, while generating them is free, accountless, and works forever in the guest tool.