What Is a 2FA? Two-Factor Authentication Explained

What is a 2FA, in plain terms?

A 2FA is a second check at sign-in that proves you are the account owner even if someone else knows your password.

Two-factor authentication (2FA) combines two different kinds of proof. The password is the first. The second comes from a separate channel, such as an authenticator app, a text message or a physical key. You may also see it called two-step verification or multi-factor authentication (MFA); in everyday use the terms overlap.

The point is simple: passwords get leaked, guessed, reused and phished. A second factor means the attacker also needs something they usually can't get from the same leak. CISA and NIST both recommend multi-factor authentication for accounts that matter.

What are the three types of authentication factors?

Authentication factors fall into three families: something you know, something you have and something you are.

Something you know: a password, PIN or security answer.
Something you have: your phone, an authenticator app, a hardware security key or a passkey stored on a device.
Something you are: a fingerprint or face scan.

True two-factor authentication uses two different families. A password plus a security question is not 2FA, because both are things you know and both can be phished in the same way. A password plus a code from your phone is 2FA, because the second item lives on a device the attacker doesn't control.

Authenticator codes vs push vs SMS vs security keys: which 2FA method is best?

Security keys and passkeys are the strongest, authenticator-app codes are a solid default, and SMS is the weakest option that is still better than no 2FA.

Method	How it works	Main weakness	Best for
Authenticator app code (TOTP)	An app shows a 6-digit code that changes every 30 seconds, generated from a secret shared once at setup.	The code can be typed into a fake sign-in page.	Most business accounts
Push approval	You tap Approve on your phone.	Fatigue attacks: someone repeatedly triggers prompts hoping you tap one by accident.	Convenience, when the service supports number matching
SMS or voice code	A code is sent to a phone number.	SIM swapping and number porting; the code also lands on one person's phone.	Only when nothing else is offered
Email code	A code is sent to an inbox.	Only as safe as that mailbox.	Low-risk accounts
Hardware security key or passkey	A device proves possession cryptographically and is bound to the real website.	You must keep a spare in case one is lost.	Admin, finance and email accounts

The big difference is phishing resistance. Codes and approvals can be tricked out of you on a lookalike page; security keys and passkeys check the website's address and refuse to answer a fake one. NIST SP 800-63B treats SMS as a restricted authenticator and describes phishing-resistant options as the stronger tier. For more on the passwordless side, see what a passkey is.

How does a 6-digit authenticator code actually work?

An authenticator code is a time-based one-time password (TOTP): your phone and the website each combine a shared secret with the current time and arrive at the same 6 digits.

When you turn on 2FA, the site shows a QR code. Scanning it copies the shared secret into your authenticator app. From then on, the app and the site both calculate a fresh code every 30 seconds, so nothing needs to be sent to you and no signal is required.

That secret is the valuable part. Anyone who holds it can generate valid codes forever, which is why it should be stored like a password and not left in a screenshot folder or a chat thread.

Why does 2FA matter more on business accounts?

Business accounts hold customer data, ad budgets, payment tools and the company's public voice, so one stolen password can cost far more than a personal login.

They also create a problem personal accounts don't have: several people need the same login. When a shared account has 2FA tied to one employee's phone, everyone else is stuck waiting for that person, and if they leave or lose the phone the whole team is locked out. Common trouble spots:

A shared social media or ad account with codes going to the founder's number.
A tool where the code is sent by SMS to a number nobody else controls.
An authenticator app on a single personal phone with no backup codes saved.
A former employee or contractor who still holds the second factor.

Good business 2FA therefore needs two things: strong factors on every important account, and a plan for who holds the second factor. The rest of this guide covers both.

How do you set up 2FA on a business account?

Set up 2FA by turning it on in the account's security settings, adding an authenticator, and saving the recovery codes before you close the page.

Start with the most valuable accounts: email, the domain registrar, banking and payment tools, cloud hosting, ad platforms and anything with admin rights.
Open the account's security or sign-in settings and choose two-step verification. Pick a security key or passkey if offered; otherwise pick an authenticator app over SMS.
Scan the QR code with your authenticator, or store the secret in your team's password manager so more than one authorised person can generate codes.
Enter the first 6-digit code to confirm it works.
Save the backup or recovery codes in a shared, access-controlled place, not in one person's notes app.
Record who holds the second factor and a hint for how to reach it, so a colleague can find it during an emergency.
Test by signing in from a private window before you log out of the working session.

If you are drafting company rules for this, the password policy template for small businesses has a ready section to adapt.

How can a team share one account that has 2FA?

A team can share a 2FA-protected account by storing the authenticator secret in a shared vault, so approved members get the code without anyone passing screenshots around.

The alternatives are worse. Forwarding SMS codes in a group chat exposes them to everyone in it, and routing everything through one phone makes that person a bottleneck. Our guide to sharing 2FA codes with a team compares the options, and sharing SMS 2FA codes covers the case where the service only offers texts.

BobWork Vault, a free password manager for teams, stores authenticator (TOTP) secrets next to the login and fills or copies the 6-digit code after the password. You can add the secret by scanning the QR code on the page or uploading a QR screenshot, and everything is decoded in the browser. Each login can note who holds its 2FA (SMS, email or app prompt, plus the teammate and a hint), and a 2FA map shows which logins depend on a single person. Backup codes are stored per login with a "mark used" option and a low-codes warning. If you want the setup details, see the free team password manager page.

What should you do when someone loses their 2FA device?

Use a backup code first, then the service's account recovery, and treat the lost device as a security event.

Sign in with one of the saved recovery codes and mark it as used.
Remove the lost device from the account and add a replacement authenticator.
Generate a fresh set of recovery codes and store them again.
Change the password if the phone may have fallen into the wrong hands.

This is the strongest argument for keeping the second factor in a shared, recoverable place: when it lives only on one phone, a lost phone becomes a locked account. The same logic applies when someone leaves, and the employee offboarding password checklist shows how to reassign the factor along with the password.

What are common 2FA mistakes to avoid?

The most common 2FA mistakes are relying on SMS everywhere, skipping recovery codes and leaving 2FA tied to one person.

Approving prompts you didn't trigger. An unexpected push is a warning sign; deny it and change the password.
Typing codes into links from emails. Open the site yourself instead.
Leaving 2FA off "temporarily". It rarely gets turned back on.
Sharing codes in group chats. Anyone with chat access can then use them.
Never testing recovery. Find out the backup codes work before you need them.

2FA also does not replace good passwords. Keep each password unique, because a reused password is still the weak link; the guide to stopping password reuse in a team shows how.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers

Questions

Is 2FA the same as MFA?

Nearly. MFA (multi-factor authentication) means two or more factors, and 2FA is the common case with exactly two. In everyday use the terms are interchangeable.

Is SMS 2FA safe enough for business accounts?

It is better than no 2FA but is the weakest common method, because attackers can hijack phone numbers through SIM swapping. Use an authenticator app, passkey or security key for important accounts and keep SMS as a fallback.

Can two people use the same authenticator code?

Yes, if both hold the same secret. Because the code is calculated from a shared secret and the time, anyone with that secret generates identical codes, which is why the secret should live in an access-controlled shared vault.

What happens if I lose my phone with my authenticator app?

You can sign in with a saved backup code, then add a new authenticator and generate new codes. Without backup codes or a second copy of the secret, you will need the service's account recovery process, which can take days.

Does 2FA stop phishing?

Not always. Codes and push approvals can be captured on a convincing fake page. Passkeys and hardware security keys resist phishing because they only respond to the real website.

Do I still need a password if I use 2FA?

Yes, in most cases. 2FA adds to the password rather than replacing it, so you still need a strong, unique password for every account.