What Is Multi-Factor Authentication?
Multi-factor authentication (MFA) requires two or more independent proofs of identity before granting access, so that stealing a single credential is not enough to get in. It is the single highest-impact control most people and organizations can add — a stolen password alone becomes useless against an account protected by a second factor.
What are the three factor types?#
MFA draws on three categories, and true multi-factor means combining different categories:
- Something you know — a password, PIN, or passphrase.
- Something you have — a phone, hardware security key, or one-time-code token.
- Something you are — a fingerprint, face, or other biometric.
Two passwords are not multi-factor; they are the same category twice. A password plus a security key is, because compromising one does not compromise the other — the same independence principle behind defense in depth.
Why isn’t all MFA equally strong?#
Because factors differ in how easily an attacker can capture or bypass them:
| Method | Strength | Weakness |
|---|---|---|
| SMS code | Basic | SIM swap, interception |
| Authenticator app (TOTP) | Good | Phishable in real time |
| Push approval | Good | MFA-fatigue prompts |
| Hardware key (FIDO2/WebAuthn) | Strongest | Phishing-resistant by design |
The gap that matters most today is phishing resistance. TOTP codes and push prompts can be relayed by an attacker who tricks you into entering them on a fake site. Hardware keys using WebAuthn/passkeys cryptographically bind the login to the real site, so a phishing page gets nothing.
MFA is the frontline defense against phishing and credential theft. It enforces the identity half of authentication vs authorization. More at the Security Fundamentals hub.
Frequently asked questions#
What are the three authentication factors?
Something you know (a password or PIN), something you have (a phone, security key, or token), and something you are (a fingerprint or face). Multi-factor authentication requires proofs from at least two different categories, so stealing one — like a password — is not enough to get in.
Is SMS-based two-factor authentication secure?
It is far better than a password alone but the weakest common form of MFA. SMS codes can be intercepted, and SIM-swapping lets attackers redirect them. For high-value accounts, prefer an authenticator app or, best of all, a phishing-resistant hardware security key using WebAuthn or FIDO2.