What is two-factor authentication?
Two-factor authentication (2FA), or more broadly MFA, is a login that requires at least two independent proofs of who you are – something you know, something you have, or something you are. The point is that a leaked password alone isn't enough to get in. It's one of the cheapest and most effective security upgrades a company can require.
Two-factor authentication, often abbreviated 2FA or the broader MFA, is one of the most talked-about security measures – and one of the most effective. Yet it’s not always clear what it actually does or why it works. Here’s the explanation, and why it’s a measure every buyer should require.
What two-factor authentication is
Two-factor authentication means a login requires at least two independent proofs that you are who you claim to be. Instead of just entering a password, you also have to verify your identity in a second, separate way.
The basic idea is simple but powerful: a single proof can be stolen or leaked, but two independent proofs are much harder to obtain at the same time. If your password ends up in the wrong hands, it still isn’t enough, because the attacker lacks the second proof.
MFA (multi-factor authentication) is the same idea, expressed more broadly: two or more factors. 2FA is simply the case with exactly two, and in everyday speech the words are often used interchangeably.
The three factor types
The strength comes from the two proofs coming from different types of factors. There are three, usually summarized as something you know, have, or are:
- Something you know. Knowledge only you should have: a password or a PIN code.
- Something you have. A physical item in your possession: a phone with an authenticator app, a security key, or a bank card.
- Something you are. A trait of yourself: a fingerprint or a facial print.
The point is combining proofs from different types. A password plus a code from your phone is strong, because an attacker would need to both know the password and physically have your phone. Two things of the same type don’t offer the same protection.
A concrete scenario
Say your password to a service leaks in a data breach at a completely different site where you happened to reuse the same password. An attacker finds it and tries to log in.
Without a second factor, they’re in immediately – the password was all that stood between the account and the attacker. But with two-factor authentication turned on, the login attempt is met with a second gate: a code from your authenticator app, which only exists on your phone. The attacker has the password but not the phone, and gets no further. Same leak, completely different outcome – that’s exactly the difference 2FA exists to make.
Not all second factors are equally strong
An important nuance: it matters which second factor you choose. They rank differently in security.
| Method | Security level |
|---|---|
| Passkeys and security keys | Strongest – very hard to phish or intercept |
| Authenticator apps | Strong – the code never leaves your device |
| SMS codes | Weakest of these – can be intercepted or hijacked, but clearly better than nothing |
Passkeys and authenticator apps are more secure than one-time codes via SMS, since SMS can be intercepted or hijacked by someone taking over your phone number. Still, even an SMS code is far better than no second factor at all. If you have the choice, pick an app or passkey – but the most important thing is having a second factor at all.
Why MFA is the cheapest security upgrade
Here’s the point that makes the decision easy for anyone making the call. Requiring a second factor stops a large share of all common account takeovers, and the technology is ready-made, mature, and cheap. Few other security measures give as much protection for as little money. That’s why MFA is almost always the first thing you should require when raising the security of a system.
It shows especially clearly against the most common type of attack. Many breaches don’t happen through sophisticated hacking, but through attackers automatically trying enormous lists of leaked usernames and passwords against service after service, hoping someone reused theirs. Such an automated mass attack relies entirely on the password alone being enough. With a second factor, the whole method falls flat, since the attacker never has the second proof for the accounts being tested. You close off one of the broadest and cheapest ways in with a single measure.
How to use this
As a buyer, you should treat MFA as a given, not an option – both for your employees’ access and for your users’ accounts where it makes sense. Ask the vendor how login is protected and whether strong second factors like passkeys and apps are supported, not just SMS.
Want to build sound login protection in from the start instead of patching it on later? At Weapp we’re happy to bring that into the systems work as early as the requirements stage.
Frequently asked questions
What's the difference between 2FA and MFA?
2FA (two-factor authentication) requires exactly two proofs. MFA (multi-factor authentication) is the broader term and requires two or more. 2FA is therefore a special case of MFA. In practice the words are often used interchangeably, since two factors is the most common setup. The point is the same either way: more than just a password is required to log in.
What are the three factor types?
Something you know – a password or a PIN code. Something you have – a phone with an authenticator app, a security key, or a bank card. Something you are – a fingerprint or a face. Security relies on combining proofs from different types, so an attacker would need to crack several independent things at once.
Are all second factors equally secure?
No, there's a clear ranking. Passkeys and authenticator apps are more secure than one-time codes via SMS, since SMS can be intercepted or hijacked by an attacker taking over the number. SMS codes are still far better than no second factor at all. If you have the choice, go with an app or passkey, but something is always better than nothing.
Why isn't a strong password enough?
Because even a strong password can leak – through a data breach, phishing, or reuse on another site that's been hacked. Once it's in the wrong hands, it gives immediate access if nothing else is required. With a second factor, the leaked password alone is worthless, since the attacker lacks the other proof.
Why is MFA called cheap security?
Because the protection it offers stands in stark contrast to what it costs to implement. Requiring a second factor stops a very large share of common account takeovers, and the technology is ready-made and cheap. Few other security measures give as much risk reduction per krona spent, which makes MFA an obvious thing to require.