A password is a single piece of proof: something you know. The trouble is, anything you know can also become known to someone else — guessed, leaked in an unrelated data breach, or handed over through a convincing phishing email. Two-factor authentication (2FA) doesn't try to make that one piece of proof unbreakable. Instead, it insists on a second, completely different kind of proof as well — and that combination is what actually stops most account takeovers.
The three official categories of proof
Security systems classify authentication proof into three factors: something you know (a password, a PIN), something you have (a phone that can receive a code, a physical security key), and something you are (a fingerprint or face scan). Genuine multi-factor authentication combines proof from at least two different categories — which is exactly why a password plus a security question isn't real 2FA: both are still just things you know, and both can be stolen or guessed the same way.
A password alone is one factor — something you know, and things you know can leak. 2FA adds a second, different kind of proof, and requires both together.
Why combining two factors is so much stronger
An attacker who steals a leaked password database now has millions of valid "somethings you know" — but almost none of the matching "somethings you have." Getting past 2FA means compromising two completely different systems at once: your password, and separately, your physical phone or security key. That second requirement doesn't need to be unbreakable on its own — it just needs to be a genuinely different kind of barrier, so a single leak or a single guess can't get through both at the same time.
Where 2FA can still be beaten — and why that's not a reason to skip it
2FA isn't immune to every attack — SIM-swap fraud can, in rare cases, redirect SMS codes, and sophisticated phishing pages can relay both factors to an attacker in real time. But these attacks require far more effort and are far rarer than the mass password-leak attacks that plain passwords are defenceless against. 2FA doesn't promise perfect security; it promises that the cheap, automated attacks that succeed against passwords alone stop working. If authentication, cyber security or any other computer science topic needs explaining with the real mechanism rather than just advice to follow, that's exactly what our GCSE computer science tutoring is for — see the full learning pathway here.
Frequently asked questions
What are the three official 'factors' in authentication?
Something you know (a password or PIN), something you have (a phone, a hardware key, a bank card), and something you are (a fingerprint, face scan, or other biometric). Genuine multi-factor authentication combines at least two of these three categories — two passwords isn't 2FA, because they're both the same factor.
Is an SMS text code as secure as an authenticator app?
Not quite — SMS codes can, in rare but real cases, be intercepted through a 'SIM swap' attack, where someone tricks a phone provider into moving your number to their SIM card. Authenticator apps generate codes locally on your device without relying on the phone network, which closes that particular attack route, though both are far safer than a password alone.
Why do some services push 2FA so hard now, when they didn't before?
Because large-scale password leaks from unrelated breaches are now common, and many people reuse passwords across multiple sites — meaning one leaked password can compromise several accounts. 2FA became a priority once services recognised that a leaked password is no longer a rare event but something that will eventually happen to most accounts.
Was this article helpful?
Tell us what you think — a correction, a question it left unanswered, or a topic you'd like covered next.
About the author
Sudershan Soni
Founder & Lead Tutor at Mostak Services — an MSc-qualified Mathematics, Science, Computer Science & STEM tutor with 20+ years of professional experience, teaching students from 11+ and GCSE to A-Level and beyond, online worldwide.
Read full profile