Term · Security & infrastructure
Two-factor authentication (2FA)
Two-factor authentication (2FA), part of multi-factor authentication (MFA), requires two different kinds of proof when signing in: something you know (a password) and something you have (a phone app, a security key) or are (a biometric). A stolen password alone is then not enough to take over the account.
[ 01 ]
Explained
Methods
- Authenticator apps generating time-based codes — widely supported and more secure than SMS.
- Security keys and passkeys — hardware or device-based credentials resistant to phishing.
- Push approvals in an app.
- SMS codes — better than nothing, but vulnerable to SIM swapping and interception.
Where to enable it first
- Company email.
- Domain registrar and DNS.
- Hosting and cloud accounts.
- Website admin panels and code repositories.
- Ad accounts (Google Ads, Meta Business).
- CRM, payment provider dashboards, banking.
- Password manager.
See access management for teams.
Recovery
Store backup codes securely, register more than one factor where possible, and make sure more than one responsible person can recover critical company accounts. Losing the only phone with the authenticator should not lock the company out.
[ 02 ]
FAQ
Frequently asked questions
Is 2FA annoying for staff?
Slightly, at sign-in. Remembered devices and passkeys reduce friction. The protection is worth it.
Can 2FA be bypassed?
Some methods, especially SMS, can be attacked; phishing-resistant methods such as security keys and passkeys are the strongest.