Two-Step Verification
Two-step verification is a security method that asks for a second proof — a code, an approval or a key — after the password when you sign in to an account. It protects the account even if the password is stolen.
| In brief | A security method that asks for a second proof — a code or an approval — after the password when signing in to an account. |
|---|---|
| Technical definition | The use of two different factors together in authentication (knowledge plus possession or biometrics); capturing a single factor is not enough to open the account. |
| Everyday example | Tapping the approval notice that arrives on your phone after your password when signing in to a banking application is two-step verification. |
| Why it matters | Passwords are frequently captured through leaks and phishing; the second step makes a stolen password useless on its own. |
| Common misconceptions |
|
A second lock on the door
When a password is the only lock on your account, a single leak opens everything. Two-step verification (2FA) adds a second question at sign-in: "Is the person who knows the password really you?" That second proof might be a code arriving on your phone, a six-digit number produced by an application, an approval notice or a physical security key. The logic is to bring two different things together: something you know (the password) and something you have (the phone or the key).
Is there a difference between the methods?
There is. A code arriving by SMS is much better than nothing; but it is known to be defeatable by methods such as copying the SIM card. Codes produced by authenticator applications are safer because they never leave the phone. Physical security keys are regarded as the most resistant option against phishing. The practical suggestion is this: turn on application-based verification where possible, at least for critical accounts such as email and banking.
Do not forget to keep the recovery codes
The one weak moment of two-step verification is the loss of the device that supplies the second step. That is why most services give single-use recovery codes during setup. Printing those codes and keeping them somewhere safe stops a lost phone from closing off access to the account. And one important rule: do not give your verification code to anyone who asks for it by telephone or by message; service providers never ask for that code out loud.
Related terms: Encryption, Smartphone, Cloud Storage