Everything You Need to Know about Two-Factor Authentication

Creating passwords is an endless loop of usernames, symbols, numbers, and weird mnemonic devices. Even if you use a password manager to make things easier, there's no guarantee your master password isn't on a sticky note behind a family photo. Finding an unsecured password is easy when you know where to look.

Two-factor authentication (2FA) helps keep your accounts safe by adding another layer that requires extra effort and, more importantly, your permission. Let's dig into some of the basics of two-factor authentication and how you can use it to protect your personal information online.

At the foundational level, two-factor authentication is a way to confirm your identity using two identifiers, or factors, instead of one.

Booking a hotel room is an excellent example of multi-factor authentication at work. Your credit card might look similar to some room keys, but there's no way it's opening a hotel room on its own. Instead, you must check in at the front desk with a photo ID. Only then does the hotel give you a key and a room number.

In this example, you need four factors to access a hotel room:

1. Credit card
2. Photo ID
3. Room number
4. Room key

But we're betting you're here to learn how two-factor authentication applies to online accounts. The core principle's the same, except you're using a password as the first factor, which triggers a prompt for the second factor—usually a one-time code that expires after a short time. The account isn't accessible unless you provide both factors.

While the type of multi-factor authentication ultimately depends on the company hosting your account, some methods are more common than others. Here's a quick rundown of the types of authentication you'll likely encounter.

Text messages (SMS) are one of the most ubiquitous 2FA methods, so there's a good chance you already use this for two-factor authentication with some accounts.¹ An SMS message is a flexible option for most phones, while email codes work well for computers and smartphones.

How it works

• Your online account asks you to select a trusted email address or trusted phone number after you enter your username and password.
• It sends a one-time verification code—usually six digits, like 396823—to your chosen contact method.
• You copy or type this authentication code to the field on the login page.
• If you don't use the code within a time limit, you'll need to request a new one.

Authenticator apps use the same numerical codes as emails and texts but require pairing the app with your online account using a QR code or other access token. The main downside is that many authenticator apps use a mobile phone—you won't find as many apps for computers.¹

How it works

• After logging into your account, you copy a code from the authentication app—it's pretty easy to copy a code by tapping on it.
  • Authenticator apps cycle codes on a set interval—usually 30 seconds—so you need to enter it before the following code appears.

Some authenticator apps skip the numeric codes in favor of a push notification where you tap a specific number (Microsoft Authenticator) or answer a yes or no question (Duo Push, Okta Verify, and Google prompts). We love the convenience of push notifications for authentication, so we highly recommend using them if available.

Pre-generated codes are basically a list of codes you receive when creating an account. They're primarily useful if you can't access another 2FA method and for some offline accounts. They don't expire, so someone with the sheet could brute-force—or try every possible code combination—to access an account.¹

How it works

• LastPass generates a printed grid and provides four coordinates when logging in: e.g., T7 F2 J5 G0.
• You look up each spot on the grid—Battleship style—and enter your code: e.g., FUHZ.

How it works

• Computers: plug the security key into your computer and tap the button at login.
• Smartphones: tap the key to your phone upon login.
  • You don't need a security key when using your phone's biometric authentication like facial recognition or a fingerprint sensor.

Contributing writer: Nathan Lawrence, SafeWise Australia

• Best Password Managers for All Your Devices
• Best Identity Theft Protection
• 31 Surprising Identity Theft Statistics
• How Do I Prevent Identity Theft Online?
• How to Keep Your Smart Home Safe from Hacking

1. Ken Reese, Brigham Young University, Proceedings of the Fifteenth Symposium on Usable Privacy and Security, "A Usability Study of Five Two-Factor Authentication Methods," August 2019. Accessed September 13, 2022.