How it works
Factors come in three kinds: something you know (a password or PIN), something you have (a phone, an authenticator app, a security key) and something you are (a fingerprint or face). 2FA combines two different kinds; multi-factor authentication (MFA) is the general term. After the password, the app asks for the second factor, often with a 'remember this device' option so it is not asked for every time.
The options differ in strength. SMS codes are better than no second factor but are exposed to SIM swapping and phishing. Authenticator apps (TOTP) are free and stronger. Push approvals are convenient but invite 'MFA fatigue' attacks, where someone sends prompts until the user taps approve. Hardware security keys and passkeys resist phishing, because they only respond to the genuine website. Every setup also needs a recovery path, usually one-time backup codes, or lost phones turn into support tickets.
Two-factor authentication (2FA) pros and cons
Pros
- Blocks attacks that rely only on a leaked or reused password
- Authenticator apps and passkeys cost nothing to run
- Expected by users, and often required by business customers
- Offered by most auth providers as a setting, not custom code
Cons
- Adds a step to sign-in, which some users resent
- Lost phones and keys need a recovery process and support time
- SMS as the second factor stays open to SIM swapping and phishing
When to use Two-factor authentication (2FA)
Pick it when
- Accounts that hold money, personal data or admin powers
- Business software whose customers' security teams ask for it
- Password sign-in is allowed, since reused passwords leak often
Skip it when
- Sign-in already uses passkeys, which pair possession and a biometric in one step
- Low-risk accounts where the extra step costs more than it protects
Two-factor authentication (2FA) pricing
Free
Authenticator apps, backup codes and passkeys cost nothing to run. SMS codes are billed per message, and some auth providers keep MFA for paid plans.
Approximate, checked September 2026.What the other tools cost
Related terms
More in Auth and identity
Ways to sign in