MFA (2FA, multi-factor authentication)
Logging in with two or more kinds of proof, such as a password plus a code from an app or a security key.
A stolen or reused password alone is then not enough. Factors differ in strength: SMS codes can be intercepted or ported, app codes can be phished on a fake page, while security keys and passkeys are tied to the real site and resist phishing. In companies, MFA is usually enforced once, at the identity provider, through SSO.
Related terms
- Passkeys: Passwordless login with a key pair stored on your device or password manager, unlocked by fingerprint, face or PIN.
- SSO (single sign-on): Logging in once with a company account (Microsoft, Google, Okta) to use many apps, managed centrally by IT.
- OAuth: A standard that lets an app act on a user’s account elsewhere (mail, calendar, files) without ever seeing the password.
