What is two-factor authentication? It is a sign-in that asks for two different kinds of proof, usually your password plus a code or a key, so a stolen password alone is not enough to get in. This guide explains the idea, compares the methods and gives the steps for five common accounts.
Never share a verification code. The FTC says anyone who asks you for your account verification code is a scammer. The code is only for you to log in. Scammers need it, along with your password, to get into your account. Google gives the same warning: never share your verification codes with anyone.
Quick answer
- Two-factor authentication (2FA) means a password plus a second proof, such as a code from your phone.
- Methods, weakest to strongest: text message codes, authenticator app codes, then a security key or passkey.
- Any second factor beats none, so turn it on today and upgrade the method later.
Jump to: What it means · The methods · Can 2FA be hacked? · Turn it on · Before you start · FAQ · What we checked
What two-factor authentication means
CISA calls multifactor authentication (MFA) a layered approach to securing your online accounts and the data they contain. It needs two or more authenticators, which CISA groups as something you know, something you have, or something you are.
A password is something you know. A phone that receives a code, or a security key, is something you have. A fingerprint or face is something you are.
With two-factor authentication on, a thief who has your password still needs the second item. CISA says users who enable MFA are significantly less likely to get hacked.
2FA, MFA and two-step verification
- MFA is the broad term. CISA defines it as two or more different authenticators.
- 2FA is the same idea with two. The FTC says 2FA needs a credential from two of the three categories, and that it is sometimes called two-step verification or multi-factor authentication. CISA lists "Two Factor Authentication" and "2FA" as other ways to say MFA.
- Two-step verification is a name some companies use. Google describes "2-Step Verification, or two-factor authentication" as one thing.
- The sources we read treat these names as the same idea in everyday use. They do not spell out any technical differences.
The methods, weakest to strongest
Google lists these options for its accounts. The weakest-to-strongest order below is ours, based on what Google, CISA and Microsoft say.
Text message codes
A service sends a code to your phone number and you type it in. This is the "two factor authentication text message" setup most people meet first.
Google says verification codes sent by texts or calls can be vulnerable to phone number-based hacks. It adds that any form of 2-Step Verification still adds security.
Microsoft says it is phasing out SMS as a method of authentication and account recovery for personal accounts.
Authenticator app codes
An authenticator app on your phone generates the code, so nothing travels by text. Google says code apps work without internet or mobile service. Instagram recommends an authentication app and names Duo Mobile and Google Authenticator.
For Microsoft's app, see our guide to setting up, moving and recovering Microsoft Authenticator.
Security keys and passkeys
A hardware security key or a passkey is the strongest option here. CISA calls phishing-resistant MFA the standard all industry leaders should strive for, and names FIDO/WebAuthn as the only widely available phishing-resistant authentication. "Phishing-resistant" means a fake sign-in page cannot trick the method into handing over what an attacker needs. NIST describes it as the ability to prevent the disclosure of authentication secrets.
Google says signing in with a passkey skips the second step. To set one up, read our guide to passkeys on iPhone and Android.
Can 2FA be hacked?
Yes, some attacks work against some methods. CISA says not all forms of MFA are equally secure. It also says MFA stops some common attacks, such as password spraying (trying common passwords on many accounts). The point is to pick a method that holds up. Here are three attacks that CISA describes.
SIM swap
A SIM swap is a form of social engineering. CISA says attackers convince cellular carriers to move control of your phone number to a SIM card they control, which gives them control of your phone number. Text codes then go to them. The FTC says an authenticator app is safer because its codes are not open to SIM swap attacks.
Fake sign-in page (phishing)
In CISA's example, a scammer emails you a link to a website that copies a company's real login page. You type your username, password and the 6-digit code from your authenticator app, and the scammer gets all three. CISA lists app-based codes as vulnerable to phishing, and SMS or voice codes as vulnerable to phishing too. This is why the never-share-a-code rule above matters.
Passkeys and security keys differ here. CISA says FIDO/WebAuthn is phishing-resistant, and that push bombing, SS7 and SIM swap attacks do not apply to it. Google says passkeys and hardware security keys protect your Google Account from phishing attacks.
Push bombing (MFA fatigue)
Push bombing, also called push fatigue, is when attackers send you push notifications over and over until you tap "Accept." CISA lists it as an attack on apps that send a simple approve-or-deny prompt. Number matching adds a step: you must type numbers shown on the sign-in screen into the app to approve. CISA lists app codes and number-matching push as resistant to push bombing.
Which methods hold up best
CISA's table orders MFA forms by how they stand up to these attacks. Phishing-resistant MFA is first. App codes and number-matching push are next. Push without number matching follows. SMS or voice codes are last, and CISA says they should only be a last-resort option.
CISA's bottom line: any MFA is better than no MFA. If phishing-resistant MFA is not possible, it suggests number-matching MFA to block mobile push bombardment and SMS-based attacks.
Turn it on
Steps are from each company's help page, as of Nov. 10, 2026.
- Open your Google Account at myaccount.google.com.
- Go to Security & sign-in.
- Under "How you sign in to Google," choose 2-Step Verification and turn it on.
- Follow the prompts.
Google says these steps might not work on work or school accounts; contact your administrator. Besides passkeys and security keys, Google lists prompts on your phone, authenticator apps, text or voice codes and 8-digit backup codes.
Apple Account
Apple says two-factor authentication is the default for most accounts. Signing in on a new device or the web needs your password plus a six-digit code shown on a trusted device or sent to a trusted phone number.
- On iPhone or iPad, open Settings. On a Mac, open System Settings.
- Tap or click your name, then Sign-In & Security.
- Turn on two-factor authentication and follow the prompts.
On the web, go to account.apple.com, sign in, choose "Upgrade Account Security" and follow the prompts. Apple says you may need a code sent to your email or to answer security questions.
Microsoft account
- Sign in and open the Security tab at account.microsoft.com/security.
- Choose "Manage how I sign in."
- Under "Additional security" and "Two-step verification," choose "Turn on."
- Follow the prompts. For Microsoft Authenticator, scan the QR code.
Microsoft says to start with an email address, a phone number or an authenticator app. It recommends two different email addresses and three pieces of security info.
These are the desktop steps. Facebook says you may see Accounts Centre or Meta Account settings depending on rollout, so labels can differ.
- Click your profile picture at the top right.
- Go to Settings and privacy, then Settings, then Accounts Centre.
- Choose Password and security, then Two-factor authentication.
- Choose the account, pick a method and follow the prompts.
Facebook lists three methods: tapping a security key on a compatible device, login codes from a third-party authentication app, and text message (SMS) codes. It offers 10 recovery login codes in case you cannot use your phone.
These are the computer steps, and menu labels can change as Meta updates its settings.
- Click More at the bottom left, then Settings.
- Choose "See more in Accounts Center."
- Go to Password and security, then Two-factor authentication.
- Select an account, choose a method and follow the prompts.
Instagram offers an authentication app (recommended), text message, or WhatsApp (turn on text message first). You need at least one. Instagram says app-based 2FA can only be turned on in the Instagram app for Android and iPhone.
Before you turn it on
- Save your backup codes. Instagram says a backup code lets you log in if you lose access to your phone or email. Google offers 8-digit backup codes you can print or download, and Facebook offers 10 recovery codes.
- Keep a second method. Microsoft says if you lose your contact methods, your password alone won't get you back into your account. Regaining access can take 30 days, and you may lose the account.
- Mind Apple's two-week window. Apple says you cannot remove two-factor authentication if your account was created with it. If you turned it on recently, you can lower security within two weeks of enrolling.
- Skip "Trust this device" on shared devices. Instagram says not to tap it on public or shared devices.
- Old devices may need an app password. Microsoft says apps and devices that cannot take codes, such as an Xbox 360, need one. It is only available when two-step verification is on.
FAQ
What is 2 factor authentication?
It is the same thing as two-factor authentication: a sign-in that needs your password plus a second proof, such as a code from your phone, a security key or a passkey.
What is the meaning of two factor authentication?
Two different kinds of proof are required to prove you are you. Per CISA, the kinds are something you know, something you have and something you are.
Is 2FA the same as MFA or two-step verification?
In everyday use, yes. MFA means two or more authenticators, and 2FA means two. The FTC says 2FA is sometimes called two-step verification or multi-factor authentication. Google describes 2-Step Verification as two-factor authentication, and Microsoft calls its version two-step verification. The sources we read do not spell out any technical differences between the names.
Is text message 2FA still worth it?
Yes. Google says any form of 2-Step Verification adds security, and CISA says any MFA is better than no MFA. Move to an authenticator app or a passkey when you can.
What we checked
We read the official pages listed in the sources on Nov. 10, 2026: CISA (two pages), Google, Apple, Microsoft, Facebook, Instagram, the FTC (two pages) and NIST. The NIST page says out-of-band authentication is not phishing-resistant. We could not open the FCC's SIM swap pages, so we do not cite them. We did not test the steps on live accounts. The Facebook and Instagram steps are the desktop paths; we did not read mobile-app paths for either. Menu labels can change.
