What is two-factor authentication? A plain-English guide
Passwords leak. A second step means a stolen password alone is no longer enough to get into your account. Here is how it works, in plain words.
Most online accounts are protected by one thing: a password. The trouble is that passwords leak all the time. A website gets hacked, someone reuses the same password on several sites, or a convincing fake page tricks them into typing it. Once a password is out, anyone who has it can sign in.
Two-factor authentication (often shortened to 2FA, and also called two-step verification) fixes this by asking for a second, separate proof that it's really you. Even if someone has your password, they can't get in without that second step.
The idea in one sentence
You prove who you are with two different kinds of things: something you know (your password) and something you have (your phone, your computer, a security key) or something you are (a fingerprint or face).
A thief who steals your password from a leaked database only has the first one. They are not sitting at your computer, so the second check stops them.
What the second step looks like
There are a few common types, and they are not equally strong:
- Text message (SMS) codes. The site texts you a six-digit code. Better than nothing, but texts can be intercepted, and criminals can sometimes move your phone number to their own SIM card.
- Authenticator codes. An authenticator app or extension creates a new six-digit code every 30 seconds from a secret shared with the website when you set it up. Nothing is sent over the phone network, so there is nothing to intercept.
- Passkeys and security keys. Instead of a code, your device proves who you are with a cryptographic key that only works on the real website. These are the strongest option and are becoming common.
We compare the first two in detail in authenticator app vs SMS codes, and explain the third in passkeys explained.
How authenticator codes work
When you turn on two-step verification, the website shows you a QR code. Behind that QR code is a long random secret. Your authenticator saves the secret, and from then on both sides do the same calculation: they mix the secret with the current time and turn the result into a six-digit number.
Because both sides know the secret and the time, they arrive at the same number, without ever talking to each other. The number changes every 30 seconds, so a code that someone sees over your shoulder is useless a minute later. This method is an open standard (known as TOTP), which is why one authenticator works with thousands of websites.
Do I really need it?
For the accounts that matter most, yes. Turn it on first for:
- Your main email account, because it can reset the passwords of everything else.
- Your password manager, if you use one.
- Banking, payment and shopping accounts.
- Work accounts, cloud storage and anything with personal documents or photos.
- Social media accounts, which are popular targets for scams.
Isn't it a hassle?
It used to be: find your phone, unlock it, open an app, find the account, read the code, type it in before it changes. That friction is why many people skip 2FA.
It doesn't have to be like that. Twofold keeps your codes in Chrome, right where you sign in. It recognizes the website you're on, puts its account at the top, and can fill the code in for you. Most sign-ins take one click.
What if I lose access?
This is the one real risk of 2FA, and it's easy to manage. When you turn on two-step verification, most sites give you a set of backup codes. Save them somewhere safe, away from your computer. And keep a backup of your authenticator itself. Our guide on backing up your 2FA codes walks through it.
The short version
- Passwords leak; a second step means a leaked password alone isn't enough.
- Authenticator codes are much safer than text messages.
- Passkeys are even stronger where websites support them.
- Save your backup codes and back up your authenticator.
Ready to start? Here is how to set up an authenticator in Chrome, step by step.