What is Two-Factor Authentication?
Two-factor authentication (2FA) requires users to prove their identity with two different types of evidence — something they know (a password) and something they have (a phone, hardware key) or something they are (a fingerprint). This makes account compromise dramatically harder because an attacker needs both factors.
Why Passwords Are Not Enough
Passwords are routinely stolen through phishing, data breaches, and credential stuffing (trying leaked passwords on other sites). Even strong, unique passwords can be compromised. 2FA adds a second barrier: even if an attacker has your password, they cannot log in without the second factor. Use the Password Generator to create strong, unique passwords as your first factor.
TOTP: Time-Based One-Time Passwords
TOTP is the most common 2FA method. During setup, the service shares a secret key (often via a QR code). An authenticator app (Google Authenticator, Authy, 1Password) uses this secret and the current time to generate a six-digit code that changes every 30 seconds:
TOTP = HMAC-SHA1(secret_key, floor(time / 30)) mod 10^6
The server performs the same calculation and accepts codes within a small time window to account for clock drift. The secret key is often encoded in Base32 — you can work with encoded data using the Base64 Encoder.
WebAuthn and Passkeys
WebAuthn (Web Authentication) is a W3C standard that uses public-key cryptography for authentication. Instead of a shared secret, the user's device generates a key pair. The private key stays on the device (in a secure enclave); the public key is registered with the service. Authentication is a cryptographic challenge-response — no secret is transmitted, so there is nothing to phish. Passkeys extend WebAuthn by syncing credentials across devices via the platform (iCloud Keychain, Google Password Manager).
Hardware Security Keys
Hardware keys (YubiKey, Google Titan) are the strongest second factor. They implement FIDO2/WebAuthn and are immune to phishing — the browser verifies the origin before signing the challenge, so a fake login page cannot capture the credential. Hardware keys are the standard for high-security environments: Google required them for all employees and eliminated phishing-based account compromises entirely.
SMS 2FA: Convenient but Vulnerable
SMS-based 2FA sends a code via text message. It is better than no 2FA, but it is vulnerable to SIM swapping (an attacker convinces the carrier to transfer your number), SS7 attacks (intercepting SMS at the network level), and real-time phishing kits that relay the SMS code to the attacker. NIST has deprecated SMS as an authentication factor for sensitive applications. Use the Hash Generator to verify that your authentication library has not been tampered with by checking file hashes.
Implementing 2FA as a Developer
For TOTP: generate a random secret, display it as a QR code (using otpauth:// URI format), and verify codes with a time-window tolerance. For WebAuthn: use a library like SimpleWebAuthn (JS) or py_webauthn (Python) — the protocol is complex, so do not implement it from scratch. Always provide recovery codes (stored hashed, like passwords) for users who lose their second factor.
MFA vs 2FA
2FA specifically requires two factors. Multi-Factor Authentication (MFA) requires two or more. In practice, the terms are often used interchangeably. Adaptive MFA adjusts requirements based on risk signals — a login from a known device and location might require only a password, while a login from a new country triggers MFA plus additional verification.
Recovery and Backup
Always generate one-time backup/recovery codes during 2FA setup. Store them securely (password manager or printed and locked away). Without recovery codes, losing access to the second factor means permanent account lockout. For TOTP, some authenticator apps support encrypted cloud backup — but this shifts the trust to the backup provider. Generate your recovery codes using a Password Generator to ensure sufficient randomness.