Two-Factor Authentication Explained: How It Works and Where It Falls Short

A password is something you know, and "something you know" has a structural weakness: it can be copied without you ever noticing. A breach, a keylogger, a phishing page that looks exactly like the real login — any of them hands the password to an attacker, and from that moment the attacker is you. Two-factor authentication, or 2FA, is the response: it adds a second proof drawn from a different category, so a stolen password alone is not enough. The strength of 2FA comes from requiring two factors of different kinds, not just two passwords.

The factors and the combinations

Authentication factors fall into three categories: something you know (a password or PIN), something you have (a phone, a hardware token, a security key), and something you are (a fingerprint, face, or other biometric). True 2FA combines two different categories. A password plus a code from an authenticator app is 2FA — knowledge plus possession. A password plus a second password is not, because both are knowledge, and compromising one likely compromises the other.

The most common second factors are time-based codes from an authenticator app, codes sent over SMS, push notifications to a trusted device, and hardware security keys. Each makes a different trade-off between security, cost, and user friction, and each fails in a different way.

TOTP and HOTP: the code-based factors

The most widely deployed second factor is a six-digit code that refreshes every 30 seconds, displayed in apps like Google Authenticator, Authy, or Bitwarden. The mechanism is an open standard called TOTP — Time-based One-Time Password. A variant called HOTP does the same thing but counts events instead of seconds. Both work the same way under the hood: at enrollment, the server and the authenticator app share a secret key, and from then on each side independently computes the current code by running that secret plus the current time (or counter) through a cryptographic function.

Shared secret (base32): JBSWY3DPEHPK3PXP
Time step: 30 seconds
Algorithm: HMAC-SHA-1
Current code (changes every 30s): 482913

Because both sides derive the code from the same secret and the same clock, they stay in sync without ever communicating after enrollment. The code is one-time, so intercepting it once buys an attacker at most a 30-second window. The weakness is the shared secret itself: it lives on both devices, and a phishing page that asks for both your password and your current code can capture both at once and forward them in real time. This is why TOTP resists bulk credential-stuffing but falls to targeted phishing.

SMS 2FA: convenient and weaker

SMS-based 2FA sends the code as a text message, and it is the most widely deployed second factor in the world because every phone can receive a text and no app installation is required. For stopping automated account takeover from a stolen password list, it works. For stopping a targeted attacker, it is the weakest of the common options.

The problem is the phone number, not the cryptography. An attacker who convinces your carrier to port your number to a SIM they control — a SIM swap — receives your 2FA texts and bypasses the second factor entirely. SIM swap attacks are well-documented, scalable, and disproportionately hit cryptocurrency accounts and high-profile individuals. SMS is also vulnerable to interception through SS7 signaling weaknesses and to increasingly competent phishing. SMS 2FA is better than no 2FA, and meaningfully worse than TOTP or a hardware key.

Where 2FA falls short

Two-factor authentication raises the cost of an attack, sometimes dramatically, but it has clear limits. Phishing defeats password-plus-code flows because the codes are themselves phishable — an attacker asks for the code, the user types it, the attacker uses it. Reverse proxies that relay a real login page in real time can capture password, code, and session cookie in a single smooth interaction.

Biometrics have their own trade-off: they are convenient and hard to phish, but you cannot rotate a fingerprint the way you rotate a password, and the legal protections around compelled disclosure vary by jurisdiction.

The strongest factor in practical use today is a hardware security key or a passkey built on WebAuthn. Passkeys are cryptographic credentials tied to a specific origin and bound to a device, which means a phishing site at a different domain cannot even request the credential — the browser refuses. This origin binding is the property code-based 2FA lacks, and it is why passkeys resist phishing in a way TOTP and SMS cannot. The remaining weaknesses of passkeys are operational — device loss, account recovery, sync across ecosystems — rather than fundamental.

A factor, not a replacement

It is tempting to treat 2FA as a license to use a weaker password, but the two are complementary, not substitutive. A weak password falls to a targeted guess or a breach immediately; the second factor then becomes the only thing standing between an attacker and the account, and second factors are not designed to be first lines of defense. A long, random, unique password generated with a Password Generator is still the foundation; 2FA is the layer behind it. The Password Strength Checker gives a quick read on whether your passwords are doing their part.

Stack the layers sensibly: a strong unique password first, TOTP or a passkey as the second factor, SMS only when nothing else is offered. Turn 2FA on wherever it is available, especially on email and password manager accounts, because those are the keys to everything else. And if a service offers passkeys, prefer them — phishing resistance is the one property that matters most once the attackers already know your password.