Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

What Is Two-Factor Authentication?

Two-factor authentication, or 2FA, is the simplest, most effective way to make sure users really are who they say they are. It strengthens security by requiring an additional layer of authentication in addition to a username and password, such as a smartphone app. 2FA helps protect against attackers who use compromised login credentials.

Why use two-factor authentication (2FA)?

As the number of security breaches continues to rise, 2FA has become an essential web security tool because it mitigates the risk associated with compromised login credentials. If a password is hacked, guessed, or even phished, 2FA prevents an attacker from gaining access without approval by a second factor.

How does 2FA work?

Processes vary among the different 2FA methods, but a typical 2FA transaction happens like this:

  • The user logs in to the website or service with their username and password.
  • The password is validated by an authentication server and, if correct, the user becomes eligible for the second factor.
  • The authentication server sends a unique code to the user's second-factor method (such as a smartphone app).
  • The user confirms their identity by providing the additional authentication for their second-factor method.

Types of 2FA methods

Authenticator apps

Authenticator apps are smartphone apps that handle the second-factor approval process as standard and push notifications.

Learn more about Duo Push


U2F security tokens

Universal 2nd Factor (U2F) is an authentication standard that uses an authenticator (a USB hardware device) and a server. A user authenticates by tapping the U2F key inserted into their computer's USB port.

Learn more about U2F


Hardware tokens

Using a hardware token, you can press a button to verify who you are. This device is programmed to generate a passcode that you must type into your two-factor prompt.

Learn more about security tokens


SMS passcodes

A unique passcode is sent to your phone via SMS that you must type into your two-factor prompt.

Learn more about passcodes


Phone callbacks

This method calls your phone and waits for you to pick up and press any key to authenticate before granting you access to your account.

Learn more about callbacks


Mobile passcodes

Similar to SMS, a two-factor authentication app can generate new, unique passcodes for you to type into the two-factor prompt. These are known as a time-based, one-time passcode (TOTP).

Learn more about mobile passcodes


Biometrics

WebAuthn allows you to use the TouchID fingerprint reader on MacOS laptops as a second factor to authenticate access to your accounts.

Learn more about biometrics