# What is Two-factor authentication?

> Requiring a second proof of identity beyond the password, such as a time-based code or hardware key.

Last reviewed: 2026-09-01

## Two-factor authentication

Category: Authentication

Also called: 2FA, multi-factor authentication, MFA

Canonical page: https://moolkey.com/glossary/two-factor-authentication

Two-factor authentication requires a second proof of identity in addition to your password, typically a time-based code from an app, a hardware security key, or a biometric check. A stolen password is no longer enough on its own, though phishable codes can still be relayed.

### The factors ranked by strength

Hardware security keys using FIDO2 are strongest, because they verify the site's identity and cannot be relayed by a phishing page. Authenticator apps generating TOTP codes are strong and universally available. SMS codes are the weakest common option, vulnerable to SIM swapping, but still far better than no second factor.

### Where to enable it first

Your email account, before anything else. Email is the reset channel for every other account you own, which makes it the single highest-value target. Then financial accounts, then your password manager, then everything else.

### Sources

- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.
- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.