Definition
Two-factor authentication (2FA) is a security technology that requires one more authentication method, in addition to your ID and password, before a login is complete. Even if your password leaks, it becomes very hard for someone else to break into your account without the smartphone or body data that only you have.
Why a Stolen Key Still Can't Open the Safe
Imagine someone peeked at your door passcode. When a thief types in the code, your phone shows a prompt: "Open the door now?" The door opens only if you approve. Even though the thief knows the code, he can't get inside. That is the basic idea behind two-factor authentication.
On the internet, even a long and complicated password can be exposed to risk. The server of a site you use often might get hacked, or malware might leak your password. Also, many people reuse the same password on several sites, so when one site gets breached, all of their accounts can fall like dominoes.
With 2FA turned on, a hacker who finds and types in your password still can't log in right away. The system sends a one-time code to your phone, or pops up an alert in an app, to double-check that it's really you. The attacker may have your password, but getting hold of the device in your hand is much harder, so most break-in attempts fail. Still, some scams use a fake login page to grab your one-time code on the spot, so 2FA is not a perfect shield.
The Three Pillars of Authentication
When a computer system checks whether you're really the owner, it uses three main kinds of proof. The first is "something you know" (knowledge). This covers the password you keep in your head, a screen-lock pattern, or a PIN.
The second is "something you have" (possession). This includes the smartphone in your hand, a code sent by text message (SMS), a one-time password generator (OTP), or a USB security key you plug into your computer.
The third is "something you are" (inherence). Biometric data such as the fingerprint scan, face recognition, or iris scan you use to unlock your phone are typical examples. Two-factor authentication boosts security a lot by combining two pillars of different kinds.
A Little More Precisely: Finding a Truly Safe Combination
People often mistake being asked for a password twice for two-factor authentication. One example is typing your login password and then answering a question like "What was your favorite childhood treasure?" But that only checks "something you know" two times. If one gets broken, the other is easy to guess too.
To get real security, you need to combine different categories. For example, pair a password you remember (knowledge) with a one-time code generated on your phone (possession). In the security field, combining factors from different categories like this is called multi-factor authentication (MFA).
Recently, hacking techniques have appeared that can even intercept codes sent by text message. That is why security experts strongly recommend using a dedicated authenticator app on your phone, or a physical security key, as your second factor instead of SMS codes.
Common misconceptions
Entering a password and then answering a security question (such as the elementary school you attended) is also two-factor authentication.
That just checks the same category, "knowledge," twice. True multi-factor authentication must mix completely different categories, such as a password (something you know) and a phone OTP (something you have).
Where you meet it
You log in to a web portal, type your password, and then have to tap "Yes" on a confirmation alert sent to your phone app before you get in.
When you send money in a banking app, you enter your password and then also touch the fingerprint sensor on your phone to prove it's you.
In one sentence
By adding your phone or fingerprint (something you have or are) to your password (something you know), you get a double lock that keeps your account safe even if the password leaks.