Two-factor authentication (2FA) explained simply
2 min read · Updated October 15, 2026
Two-factor authentication asks for a second proof of identity in addition to your password, such as a code from an app, a security key or a passkey. Even if your password leaks, an attacker cannot log in without that second factor. Enable it first on email, banking and social accounts.
How 2FA works
A password is something you know. A second factor is something you have or are: a phone app that generates codes, a physical key, or a fingerprint. Requiring both makes stolen passwords far less useful.
Types of 2FA, from strongest to weakest
- ✓Passkeys and hardware security keys: resistant to phishing.
- ✓Authenticator apps: time-based codes generated on your device.
- ✓SMS codes: better than nothing, but vulnerable to SIM-swap attacks and interception.
- ✓Email codes: convenient but only as secure as the email account itself.
Is your login already in a leak?
Strong habits help most when you know which accounts are already exposed. Check your email address for free.
Where to turn it on first
- ✓Email accounts (the key to every reset).
- ✓Banking, payment and investment apps.
- ✓Cloud storage, Apple, Google and Microsoft accounts.
- ✓Social media and messaging apps.
Do not get locked out
Save your backup codes somewhere safe and offline, and keep recovery details up to date. Consider adding a second authenticator or security key as a spare.
Frequently asked questions
Is 2FA the same as MFA?+
MFA (multi-factor authentication) is the general term. 2FA uses exactly two factors.
Can attackers bypass 2FA?+
Some phishing attacks try to capture codes in real time. Passkeys and security keys resist this best.
What if I lose my phone?+
Use backup codes or a spare factor. That is why setting them up in advance matters.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.