What is 2FA?
A Second Lock on the Same Door
Two-factor authentication asks for something you know - usually a password - plus something you have, such as a code or a security key. A leaked password alone is then no longer enough to get in. It is the highest-impact security change most people can make, and it comes in strong and weak varieties.
How 2FA Works
You sign in with your password as usual. Before letting you through, the service asks for a second proof from a different category: a code, a tap on a security key, a prompt on your phone.
The password confirms you know a secret. The second factor confirms you hold a specific object. An attacker on the other side of the world can obtain the first from a breach; the second requires being in the same room as you.
That's the whole idea, and it's why 2FA blocks the overwhelming majority of automated account takeovers - see Why Password Reuse is Dangerous for how those attacks actually run.
The Second Factors, From Weakest to Strongest
Not all second factors offer the same protection. In practice you'll meet four.
Email codes. The weakest. If your mailbox is compromised - and it is the account attackers target first - the second factor is in the same place as the reset link.
SMS codes. Better, but tied to a phone number rather than a phone. Numbers can be transferred to an attacker through SIM swapping, which is why standards bodies now treat SMS as a restricted method. See SMS vs TOTP.
Authenticator codes (TOTP). A six-digit code computed from a shared secret and the current time, with no network involved. Solid, widely supported, and the right default for most accounts. On a Seedkeeper PRO the secret lives in the secure element instead of a phone app - see Adding a TOTP Account.
Security keys and passkeys. The only option that resists phishing, because the credential itself verifies the site's domain before responding. See What is a Passkey?.
What 2FA Does Not Protect Against
Two blind spots are worth knowing, because they're where attacks have moved.
Real-time phishing. A fake page collects your password, then your code, and relays both to the real site inside the thirty-second window. Your 2FA worked exactly as designed and the attacker is in anyway. Only domain-bound credentials stop this - see Passkey vs OTP.
Account recovery. Most services keep a fallback route for people who lose their second factor. That route is a legitimate way in, and it is often protected by nothing more than access to your mailbox.
Where to Enable It First
Enabling 2FA everywhere at once is a project. Enabling it in the right order takes ten minutes and captures most of the benefit:
- Email, because it resets everything else
- Financial accounts - banking, PayPal, exchanges
- Anything storing personal documents or customer data
- Social accounts, which are used to reach the people who trust you
Keep Your Recovery Codes
When you enable 2FA, most services show a list of one-time recovery codes. People close that screen and regret it later.
Save them somewhere that is neither your phone nor your inbox. A secure note on a Seedkeeper is a good home: offline, hardware-backed, and available even if the phone holding your authenticator is gone.
Everything on one device
Seedkeeper PRO stores your passwords, your TOTP codes and your passkeys on a single EAL6+ secure element, FIDO2 Level 1 certified. No cloud, no account, no vendor lock-in.
Get your Seedkeeper
FAQ
What is two-factor authentication?
A sign-in process requiring two different kinds of proof: something you know, such as a password, plus something you have, such as a one-time code or a security key. A stolen password alone is then not enough to access the account.
Is 2FA the same as MFA?
2FA is multi-factor authentication with exactly two factors. MFA is the general term and allows more. For most consumer accounts the two mean the same thing in practice.
Which type of 2FA should I use?
A passkey or security key where the service supports it, since those resist phishing. An authenticator app or hardware TOTP everywhere else. Use SMS only when nothing better is offered.
Can 2FA be bypassed?
Code-based 2FA can be defeated by real-time phishing, where a fake page relays your password and code to the real site immediately. A weak account recovery process can also bypass it. Phishing-resistant methods close the first gap.
What happens if I lose my second factor?
You fall back on the recovery codes issued when you enabled it, or the service's account recovery process. This is why saving those codes somewhere safe and offline matters as much as enabling 2FA in the first place.