Two-factor authentication, or 2FA, requires two separate pieces of proof before letting you into an account: something you know, like a password, and something you have, like your phone.

Why a strong password alone isn't enough

Even a long, random, unique password can be exposed through phishing, a data breach at the company storing it, or malware on your device. 2FA means that a leaked password alone still isn't enough for an attacker to get in.

Common forms of 2FA

• A time-based code from an authenticator app, which regenerates every 30 seconds
• An SMS code sent to your phone, which is convenient but more vulnerable to interception
• A physical security key, generally considered the strongest option

2FA and password strength work together

Enabling 2FA doesn't mean you can relax on password strength — it means an attacker needs both your generated, unique password and your second factor, which together make an account dramatically harder to break into than either protection alone.