What Is 2FA? Two-Factor Authentication Explained (2026)

If you only do one thing to secure your accounts this year, make it 2FA. Two-factor authentication adds a second lock to your logins, so that a stolen password — the single most common way accounts get hijacked — is no longer enough to get in. This guide explains what 2FA is, the types ranked by how secure they are, and how to switch it on.

The short answer

• 2FA = proving your identity with two different factors, not just a password.
• The factors: something you know (password) + something you have (app code, hardware key, phone) or something you are (fingerprint/face).
• It means a stolen password alone can't log in — the highest-impact security step for most people.
• Best methods: hardware key or authenticator app; avoid relying on SMS where you can.

What "two factors" actually means

Authentication factors come in three categories, and 2FA combines two different ones:

• Something you know — a password or PIN.
• Something you have — a code from an authenticator app, a hardware security key, or your phone.
• Something you are — a fingerprint or face scan.

Two passwords aren't 2FA (same category). A password plus an app code is, because an attacker would need to defeat two independent things. That's the whole security gain.

The types of 2FA, ranked by security

1. Hardware security keys (FIDO2 / passkeys) — the strongest. Cryptographically phishing-resistant: even a perfect fake site can't capture a reusable code. See what is a passkey.
2. Authenticator apps (TOTP) — a 6-digit code that changes every 30 seconds, generated on your device with no network needed. Far safer than SMS and the best default for most accounts.
3. Push notifications — tap "approve" on your phone. Convenient, but vulnerable to "MFA fatigue" (attackers spam approvals hoping you tap yes).
4. SMS codes — better than nothing, but the weakest: vulnerable to SIM-swapping and interception.

How to turn 2FA on

It takes two minutes per account:

1. Go to the account's Security / Login settings and find "two-factor" or "two-step verification."
2. Choose authenticator app (or a hardware key) over SMS if offered.
3. Scan the QR code with your authenticator app, then enter the code it shows to confirm.
4. Save the recovery codes somewhere safe — ideally in your password manager.

Prioritise your email first (it can reset everything else), then your password manager, banking, and social accounts.

The bottom line

2FA means logging in with two different proofs instead of one, so a stolen password can't open your account by itself. Turn it on everywhere that matters, prefer an authenticator app or hardware key over SMS, and save your recovery codes before you need them. It's the highest-return security habit there is — start with your email today. Next, compare the best authenticator apps and learn how passkeys take 2FA further.