Short answer
In one sentence
Two-factor authentication, or 2FA, means you prove who you are in two different ways to sign in, usually a password plus a code from your phone.
Services use different names for it. Google calls it 2-Step Verification, and the Canadian Centre for Cyber Security uses the broader term multi-factor authentication, or MFA.
Google’s help page explains why that helps: “With 2-Step Verification, or two-factor authentication, you can add an extra layer of security to your account in case your password is stolen.”
More guides: why a code in an app beats a code by text message, and why you should never share your 6-digit code.
Three kinds
Three kinds of proof
The Canadian Centre for Cyber Security says: “2FA is a form of MFA. In both cases you are using two different methods of verifying your identity, known as authentication factors.” Its longer publication, ITSAP.30.030, sorts the factors into three kinds:
- “Something you know: Typically, your passphrase, password, or Personal identification Number (PIN).”
- “Something you have: This factor can include a hard token (such as a USB key or access card) or a soft token (such as an authenticator app or SMS message).”
- “Something you are: This factor relies on a unique biometric characteristic (such as fingerprints, retina, or facial structure).”
The kinds must differ. The Centre’s explainer notes that “two-step verification uses two of the same type, MFA requires two or more different authentication factors to be applied.” Despite its name, Google’s 2-Step Verification asks for two different kinds, such as your password and your phone.
Second step
Where the second step comes from
Most often it is a code. It can arrive by text message, or be made by an authenticator app on your phone. A hardware key or a passkey can do the job too. The Centre advises: “Whenever possible, choose MFA options that do not rely on SMS like an authenticator app, or options that are phishing-resistant such as passkeys, or hardware tokens.”
Google gives a reason for the caution about texts: “Although any form of 2-Step Verification adds account security, verification codes sent by texts or calls can be vulnerable to phone number-based hacks.” Our guides compare texted codes with app codes and passkeys with codes.
Limits
What 2FA does not do
The Centre is plain about it: “Like all cyber security measures, MFA is not failproof.” A code can still be talked out of you, which is why our guide on never sharing your 6-digit code matters. ITSAP.30.030 also says: “Implement phishing-resistant MFA technology: For example, fast identity online (FIDO) based-solutions are strongly recommended to secure online accounts.”
Next
Where to start
Begin with the accounts that matter most. The Centre advises you to “take the extra care for Apps and sites that contain key pieces of your identity – be it personal or financial”.
Then check which apps and websites work with an authenticator app, and save your backup codes before you need them: see what to do if you lose your phone.
