Passwords get leaked far more often than most people realize — through data breaches, phishing pages, or simply being reused across too many sites. Two-factor authentication, often shortened to 2FA, adds a second checkpoint that makes a stolen password alone much less useful to an attacker.
How it actually works
After entering a correct password, 2FA asks for a second piece of proof: a code sent by text, a code generated by an authenticator app, or a physical security key. Even if someone has your password, they're stopped at this second step unless they also have access to your phone or key.
Not all 2FA methods are equal
- SMS codes: convenient but vulnerable to SIM-swap attacks in rare cases
- Authenticator apps: more secure, since codes are generated on the device itself
- Physical security keys: among the strongest options, since they require the actual device to be present
- Push notifications: quick to approve, but can be misused if you're not careful about approving unfamiliar requests
The strongest password in the world can still be stolen. A second factor is what turns a stolen password into a dead end.
Where to start
Enabling 2FA on email, banking, and any account tied to financial or personal information gives the biggest security return for the least effort. Most major platforms now offer it as a free setting buried a few taps into account security settings — worth the two minutes it takes to turn on.
A real-world example
An employee's email password was exposed in an unrelated data breach on a different website where they'd reused the same password. Attackers tried that password against the employee's work email — and it worked. But because two-factor authentication was enabled, the login attempt still required a one-time code from the employee's phone, which the attacker didn't have. The breach attempt failed at the last step, turning what could have been a serious incident into just a suspicious login alert.