2Factor

2factor, commonly known as two-factor authentication (2FA), is a security mechanism that strengthens access controls by requiring two distinct forms of evidence from separate categories to verify a user’s identity. By moving beyond a single password, 2factor reduces the risk that a stolen credential alone leads to unauthorized access, since an additional factor is needed.

Typically, the first factor is something the user knows (a password or PIN). The second factor is usually something the user possesses (a hardware token, a mobile authenticator app producing time-based codes, or a one-time SMS code) or something the user is (biometric data). Some implementations require two factors from different categories, such as knowledge plus possession or possession plus inherence.

Common implementations include time-based one-time passwords (TOTP) and counter-based one-time passwords (HOTP) generated by authenticator apps; hardware security keys using FIDO2/WebAuthn; and SMS codes. Modern standards favor phishing-resistant authenticators and integration with single sign-on (SSO) systems and MFA platforms.

2factor is widely deployed across consumer services and enterprise environments. It improves security but is not failure-proof: weaker options like SMS can be compromised, and lost devices or recovery codes can create access risks. Stronger methods use hardware keys or biometric-capable devices, and organizations may adopt risk-based or step-up authentication policies.

See also: multi-factor authentication, WebAuthn, FIDO2, TOTP, HOTP.