Two-Factor Authentication Explained: How 2FA Actually Works

Two-factor authentication (2FA) means a login needs two different kinds of proof — usually your password plus something only your phone or a security key can produce. A stolen password alone then stops being enough to get in. Microsoft wrote in 2019 that multi-factor authentication "can block over 99.9 percent of account compromise attacks", and the US cybersecurity agency CISA says users who enable it are "significantly less likely to get hacked". Not all 2FA is equal, though: codes and push prompts can still be tricked out of you by a convincing fake site, while security keys and passkeys cannot. This guide explains how each method works so you can choose sensibly; for step-by-step setup, see our 2FA setup playbook.

The three kinds of proof

Two factors from the same category — a password plus a security question — are not 2FA. The protection comes from an attacker needing two different kinds of access at once.

How the six-digit codes work

Authenticator apps such as Google Authenticator and Microsoft Authenticator use a standard called TOTP (time-based one-time password, RFC 6238). When you scan the QR code during setup, the app and the website store the same secret key. From then on, both sides independently calculate a code from that key and the current time — nothing is sent to your phone.

A worked example of the time step. RFC 6238 counts time in steps of 30 seconds by default from the Unix epoch. At Unix time 1,792,000,000, the step number is 1,792,000,000 ÷ 30 = 59,733,333 (rounded down). The app runs the secret key and that step number through a hashing function (HMAC-SHA-1 by default) and shortens the result to six digits. Thirty seconds later the step becomes 59,733,334 and a completely different code appears.

Two consequences:

• It works offline. The phone needs the correct time, not a signal.
• A code is briefly reusable by an attacker who obtains it in real time. The standard recommends servers accept at most one time step of network delay, but a phishing site that relays your code within seconds can still use it.

Why some 2FA can still be phished

Imagine a fake bank login page. You type your password; the attacker's server forwards it to the real bank instantly. The bank asks for a code; the fake page asks you; you type it; the attacker forwards that too and is in. Codes by text message, codes from apps and "approve this sign-in?" push prompts can all be relayed this way, because you are the one handing them over.

Security keys and passkeys work differently. They use the FIDO/WebAuthn standard: the key checks which website is actually asking and will only answer the genuine domain. A look-alike site gets nothing useful. CISA states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication".

Push fatigue. Attackers who already have your password sometimes trigger dozens of push prompts hoping you approve one to make them stop. CISA recommends number matching — typing the number shown on the login screen into your phone — to block this. If you get a prompt you did not start, deny it and change your password.

The methods compared

Any of these is far better than a password alone — CISA's own wording is that "any MFA is better than no MFA". Start with what your accounts support, then upgrade your most important ones.

Which method for which account

• Email: the strongest method offered — it can reset everything else. A security key or passkey if available.
• Password manager: an authenticator app at minimum, a security key ideally.
• Banking: the strongest option your bank supports, and never approve a request you did not start.
• Social media and shopping: an authenticator app is a good default.

Our best 2FA apps guide compares authenticator apps, and the YubiKey review covers hardware keys. If you are deciding whether to skip codes entirely, read passkeys vs 2FA.

The part people forget: recovery

Every method needs a way back in if the device is lost. Save the recovery codes each service gives you when you turn 2FA on, and store them somewhere other than the phone — 2FA recovery codes explained covers where. Changing phones? Follow moving 2FA to a new phone before you wipe the old one. Password managers such as Proton Pass can store TOTP codes alongside your logins — convenient, with trade-offs explained in 2FA codes in your password manager.

Why the Ranking Is What It Is

The security ordering of 2FA methods is not arbitrary — it follows from one question: can the second factor be relayed to an attacker by a convincing fake login page?

The bottom row is categorically different rather than incrementally better. A security key or passkey checks the site's identity before it responds, so a fake page cannot obtain anything usable. Every method above it depends on you correctly identifying the site, which is exactly what phishing is designed to defeat.

NIST SP 800-63B is explicit about this distinction, and the article above quotes its definition directly.

Recovery Is the Part That Fails

More people lose access through their own 2FA than are ever attacked through it. Setting up recovery at enrolment time, not later, prevents nearly all of it:

• Save backup codes somewhere that survives losing your phone. Printed, or in

your password manager on a device that is not the phone itself.

• Enrol a second authenticator where the service allows it. Two keys, or an app

on a second device.

• Do not rely on a single physical key. Anyone using hardware keys seriously

registers two and keeps one elsewhere.

• Check whether your authenticator app backs up its secrets, and whether that

backup is encrypted. Some do, some do not, and the difference is discovered at the worst moment.

• Re-check recovery after changing phones. Migration silently drops entries more

often than it should.

Where to Enable It First

Not every account justifies the friction, and starting everywhere is why people stop. In order:

• Email, because it resets everything else.
• Your password manager, because it holds everything else.
• Banking and payment.
• Your mobile carrier account, which is what SIM-swap attacks target.
• Cloud storage and any account tied to work.
• Social accounts, especially any used to sign in elsewhere.

Then, as passkey support widens, replace codes with passkeys on those same accounts in the same order. The practical comparison of apps is in best 2FA apps, and how attackers get the first factor in the first place is in how hackers get your password.

Frequently asked questions

What is two-factor authentication in simple terms?

A second lock on your account. After your password, the site asks for proof from something you have — a code from your phone, a tap on a security key — so a stolen password alone is not enough.

How do authenticator app codes work without internet?

The app and the website share a secret key set up when you scan the QR code. Both calculate the same six-digit code from that key and the current time, changing every 30 seconds by default, so no message needs to reach your phone.

Can two-factor authentication be hacked?

Codes and push approvals can be phished in real time by a fake login page, and SMS codes are exposed to SIM swaps. Security keys and passkeys based on FIDO/WebAuthn resist phishing because they only respond to the genuine website.

Is SMS 2FA better than nothing?

Yes. It still stops attackers who only have your password. Read is SMS 2FA safe? for when to replace it.

Sources checked 16 October 2026: Microsoft Security blog, "One simple action you can take to prevent 99.9 percent of account attacks" (20 August 2019); CISA, "More than a Password" (cisa.gov/mfa, archived page); IETF RFC 6238, TOTP. Editorial content.