---
title: "What Is Two-Factor Authentication (2FA)?"
slug: what-is-two-factor-authentication
category: tech
category_label: "Tech"
author: "BrainWavePost Staff"
date: 2026-06-06
tags: ["2fa", "security", "passwords", "mfa"]
read_time_minutes: 6
canonical_url: https://brainwavepost.com/article/what-is-two-factor-authentication
source: BrainWavePost
---

# What Is Two-Factor Authentication (2FA)?

*Tech · 2026-06-06 · BrainWavePost Staff · 6 min read*

> A plain-English, fully sourced explainer on two-factor authentication using guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and NIST.

> **How this article is sourced** _(info)_
>
> Every claim below comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. National Institute of Standards and Technology (NIST). [1][2][3]

Two-factor authentication (2FA) is a form of multi-factor authentication (MFA) that requires you to present two different types of evidence to prove who you are when signing in. CISA describes MFA as 'a layered approach to securing data and applications where a system requires a user to present a combination of two or more credentials to verify a user's identity for login.' [1]

## The three classic 'factor' categories

NIST's Digital Identity Guidelines (SP 800-63B) group authentication factors into three categories: something you know (e.g. a password or PIN), something you have (e.g. a phone or security key), and something you are (e.g. a fingerprint or face scan). True 2FA combines two different categories — not, for example, two passwords. [2]

## Why CISA recommends turning it on

CISA's 'Secure Our World' guidance states that enabling MFA on important accounts (email, banking, social media) makes you 'significantly less likely to get hacked,' because an attacker who steals your password still cannot sign in without the second factor. [1][3]

## Common second factors, from weakest to strongest

- SMS one-time codes — better than nothing, but NIST notes SMS is more vulnerable to interception than other methods. [2]
- Authenticator apps (TOTP codes) — codes generated on your device, not sent over the phone network. [2]
- Push approvals in a trusted app — you approve sign-ins on a device you already control. [1]
- Hardware security keys (FIDO2/WebAuthn) — physical keys that NIST classifies as phishing-resistant authenticators. [2]

> **Where to start** _(tip)_
>
> CISA recommends turning on MFA first on your email account, because email is often used to reset the password on every other account you own. [3]

## References (clickable)

- [1] CISA — More than a Password (MFA explainer): https://www.cisa.gov/MFA
- [2] NIST SP 800-63B — Digital Identity Guidelines, Authentication and Lifecycle Management: https://pages.nist.gov/800-63-3/sp800-63b.html
- [3] CISA — Secure Our World: Turn On MFA: https://www.cisa.gov/secure-our-world/turn-mfa

---

_Canonical article: [https://brainwavepost.com/article/what-is-two-factor-authentication](https://brainwavepost.com/article/what-is-two-factor-authentication) — © BrainWavePost. Educational content; see the article page for full disclaimers._