2FA · two-factor authentication
/ two-eff-AY /
2FA asks for a second proof of identity on top of your password — usually a short code from your phone. The idea is simple: even if a thief steals your password, they still can't get in, because they don't have the second piece. It's the deadbolt on top of the door lock.
The 'two factors' are deliberately different kinds of thing: something you KNOW (your password) and something you HAVE (your phone, or a code from an app like Google Authenticator). A leaked password is only knowledge — it doesn't put your physical phone in the attacker's hands.
You'll usually meet it as a six-digit code that refreshes every 30 seconds, or a tap-to-approve notification. Slightly more friction for you, hugely more work for an attacker — which is why turning it on is the single best thing you can do for an important account.
Password: •••••••• ✓ (something you know) Enter code from app: 481 920 ✓ (something you have) → access granted
Two factors of different kinds: knowing the password isn't enough without the code on your phone.
Codes from an authenticator app beat codes sent by text message — SMS can be hijacked by 'SIM-swapping' your number to a new phone. Use an app where you can.