two-factor authentication
noun
Two-factor authentication uses two independent forms of evidence from different categories to grant access to an account or system.
She uses two-factor authentication with a password and security key to access the administration panel.
Two-factor authentication, often abbreviated to 2FA, adds a second check during sign-in. Obtaining a password is therefore not enough for an attacker to gain access. The protection depends on the method: an SMS code can be intercepted or obtained through phishing, for example.
Which two factors do you use?
Glossary · In briefauthenticationAuthentication is the process by which a system verifies the claimed identity of a user, device or application.Read more can ask for something you know, something you have or something you are. A password or PIN belongs to the first category. A phone, authenticator app or physical security key is something you have. A fingerprint or facial scan is a biometric characteristic: something you are.
Two-factor authentication requires checks from different categories. A password and an additional security question are both something you know, so they do not form two independent factors. A password combined with a security key does combine two categories.
2FA and two-step verification
Two-factor authentication and two-step verification are often used interchangeably. However, two-step verification mainly describes two checks performed in sequence. They do not necessarily use different types of evidence. With 2FA, combining two different categories is the defining feature.
Not every second factor provides the same protection. An authenticator app generating temporary codes can still be vulnerable to phishing. A security key that checks the website before granting access can offer better protection against this. The appropriate method depends on the account's risk and the system's capabilities.