Two-Factor Authentication Explained
Security - 6 min read - Published 2026-08-27
Two-factor authentication (2FA) requires proving your identity with two different types of evidence: something you know (your password) and something you have (a device generating one-time codes). Even if your password leaks in a breach, an attacker without physical access to your second factor generally can't get in.
How TOTP Codes Are Generated
The most common form of app-based 2FA uses TOTP (Time-based One-Time Password), defined in RFC 6238. When you scan a setup QR code, your authenticator app and the service you're securing both receive the same secret key. From that point on, both sides independently compute a code by combining that shared secret with the current Unix time (rounded to a 30-second window) through a cryptographic hash function. Because both sides start from the same secret and the same clock, they land on the same code without ever transmitting it over the network during normal logins.
This is why TOTP codes expire every 30 seconds and why your phone's clock needs to be roughly accurate - the whole system depends on both sides computing the same time window.
Why This Actually Stops Attacks
Password breaches are common precisely because passwords are static and often reused across sites. A TOTP code is different every 30 seconds and useless to an attacker even seconds after you use it - there's no static secret being transmitted that could be intercepted and replayed later, the way a password can be.
What 2FA Doesn't Protect Against
TOTP isn't invincible. Real-time phishing (a fake login page that immediately relays your password and current code to the real site) can still work, since the attacker is using your code within its 30-second window, not trying to reuse an old one. It also doesn't help if your device itself is compromised by malware, or if your account recovery process has a weaker fallback (like SMS reset or security questions) that bypasses 2FA entirely.
Backup Codes Matter
Always save the backup codes generated when you set up 2FA, stored somewhere separate from the device running your authenticator app. If you lose that device, backup codes are usually the only way back into your account without going through a support process - and losing your only second factor is a genuinely common way people get locked out of their own accounts.