What is 2FA? Two-factor authentication explained simply

Two-factor authentication (2FA) means logging in with two different kinds of proof: something you know (your password) and something you have (usually your phone). Even if someone steals your password, they can't get in without the second factor.

How authenticator codes work

When you turn on app-based 2FA, the website shows a QR code containing a secret key. Your authenticator app (such as Google Authenticator or Microsoft Authenticator) stores that key. Every 30 seconds, the app combines the key with the current time to calculate a new 6-digit code. The website does the same calculation, so when the codes match, it knows you have the key. This method is called TOTP, time-based one-time passwords, and is defined in an open standard (RFC 6238).

SMS codes vs authenticator apps

Codes sent by text message are better than nothing, but they can be intercepted, for example through "SIM swap" fraud, where criminals convince a mobile operator to move your number to their SIM. Authenticator apps work offline and are generally more secure. Hardware security keys are stronger still.

Don't get locked out

• Save your backup codes when you set up 2FA, and keep them somewhere safe, offline.
• Keep a copy of the secret key for important accounts in a secure place, or use an authenticator app with encrypted backup.
• Moving to a new phone? Transfer your authenticator accounts before you reset the old one.

Codes not working?

Because codes depend on time, the most common cause of rejected codes is a wrong clock on your phone or computer. Set the time to update automatically.

Generating a code in your browser

If you have a secret key, for example while setting up an account on a computer, DocNova's 2FA code generator shows the current code. The key is processed only in your browser and never saved. Treat 2FA keys like passwords, and use an authenticator app for everyday logins.