Glossary
What is two-factor authentication (2FA)? vs two-step, and the strength of each method
Two-factor authentication (2FA) adds a different kind of proof on top of your password. How it differs from two-step verification, the strength of each method (SMS, authenticator app / TOTP, passkey), and how to choose. Defensive, no attack steps.
"Even if my password leaks, that alone won't let anyone in" — that's what two-factor authentication (2FA) buys you. Here's how it differs from the often-confused two-step verification, and how the methods compare (no attack steps).
"Two factors" vs "two steps" — what's the difference?
The words look alike, but it's simple once you hold the goal in mind. Authentication factors fall into three categories:
Two-factor authentication (2FA) mixes two different categories (e.g. password = knowledge + an authenticator app = possession). The point: if one is broken, a different category still stands, so an attacker can't get in. Two-step verification (2SV), by contrast, only means "check twice," and both steps can be the same category (password + security question is two steps but not two factors). So if you truly want strength, the key is to mix different categories.
Method strength: it comes down to "can you hand it to a phishing site?"
Even with 2FA on, strength varies a lot by method. The decider is whether you could accidentally give the "proof" to a fake site.
Strong ── Passkey / security key (FIDO2)
Signature bound to the domain — structurally can't be presented to a fake site (phishing-resistant)
Medium ── Authenticator app (TOTP)
Stronger than SMS, but a human reads the code — so it can be handed to a fake site
Weak ── SMS / email codes
Weak to SIM swaps and relaying; still stronger than a password alone
Weak: SMS / email codes
- a human reads and types the code — so it can be handed straight to a fake site
- exposed to SIM swapping and adversary-in-the-middle (AiTM) phishing
- still clearly stronger than a password alone (far better than nothing)
Strong: passkey / security key (FIDO2)
- the signature is bound to the site's domain — impossible to present to a fake site
- resistant even to adversary-in-the-middle phishing (phishing-resistant MFA)
- an authenticator app (TOTP) sits in between — stronger than SMS, but still presentable to a fake site
This site's view: turn it on first, then move to methods you 'can't hand over'
The most common 2FA failure is overthinking "which is strongest" and ending up with none at all. The priority is clear — turn on some 2FA on every account first, then raise your keys-to-the-kingdom accounts (email, domain, payments) to a method you can't hand to a phishing site (passkeys). This site does not count "spotting the fake site by being careful" as a defense strategy. Rather than human vigilance, lean on methods where the proof structurally can't be given to a fake site.
Read next
- Glossary: what a one-time password (OTP) is (what the authenticator-app code really is — TOTP/HOTP/SMS) · what a passkey is (the top tier you can't hand over)
- Glossary: what phishing is (understand the AiTM attacks that target 2FA)
- Learn: choosing MFA the right way (method selection in practice)
FAQ
QAre two-factor and two-step authentication the same thing?
Strictly, no. Two-factor authentication (2FA) combines two different 'factors' — knowledge (password), possession (phone, key), or inherence (fingerprint, face). Two-step verification (2SV) just means 'check twice,' and the two steps aren't necessarily different factors (e.g. a password plus a security question are both knowledge — two steps but not two factors). In practice they overlap a lot, but the goal is to mix different categories so breaking one doesn't get you in.
QIs SMS-based 2FA still worth it?
Yes. It's clearly stronger than a password alone and stops most takeovers from password reuse or leaks. But SMS is a prime target for SIM swapping and adversary-in-the-middle phishing, so as a method it's the weakest tier. The right read is 'much better than nothing, but not the finish line.' Move to an authenticator app (TOTP) or a passkey where you can.
QWhich method should I pick?
The rule of thumb: the harder a method is to hand to a phishing site, the stronger it is. Strongest to weakest: passkey / hardware security key (FIDO2) > authenticator-app code (TOTP) > SMS/email. For 'keys to the kingdom' accounts — email, your domain, payments — prefer a phishing-resistant method like passkeys. Realistically: turn on some 2FA everywhere first, then raise your most important accounts to the strongest method.