What is 2FA?
2FA stands for “two-factor authentication”. You’ll also see it called two-step verification or two-step authentication. When more than two steps are involved, it’s called multi-factor authentication (MFA).
Authentication factors fall into three groups:
- Something you know: a password or PIN.
- Something you have: a phone, an authenticator app, a security key.
- Something you are: a fingerprint, facial recognition.
2FA combines at least two of these groups. The most common example is entering a 6-digit code generated by an app on your phone after your password.
Why does 2FA matter so much?
Passwords can be stolen through breaches, phishing pages or plain guessing. On an account with 2FA turned on, knowing the password isn’t enough on its own; an attacker also needs the second factor. That’s why we strongly recommend turning on 2FA for critical accounts such as email, banking, cloud storage and your password manager.
What are the 2FA methods, and which is the most secure?
Not every 2FA method offers the same level of protection. As a rule, the harder it is to intercept a code or trick you into handing it over, the stronger the method:
- SMS or email codes: Easy to use and better than nothing. But they’re the weakest option against SIM-swap fraud and phishing.
- Authenticator app (TOTP): An app on your phone generates a new code every 30 seconds. It doesn’t need an internet or mobile connection and is more secure than SMS. It’s the most widely used method.
- Push notifications: You approve a “Is this you signing in?” prompt on your phone. It’s convenient, but prompts approved without thinking are a risk.
- Hardware security key: A physical key that works over USB or NFC. Because it’s bound to the domain, it’s highly resistant to phishing.
- Passkey: Can replace both the password and the second step on its own; the key on your device and biometric verification work together. Details are in our passkey guide.
How does an authenticator app work?
Most authenticator apps use the TOTP standard (Time-based One-Time Password, RFC 6238):
- When you turn on 2FA for a site, it shows you a QR code. That code contains a secret key shared between the site and your authenticator app.
- The app uses that secret key and the current time to calculate a 6-digit code every 30 seconds. The site does the same calculation; if the codes match, the sign-in is approved.
- Because the codes are generated on the device, no internet connection is needed; the device clock just has to be accurate.
The secret key (the contents of the QR code) is the second key to your account, so don’t leave it lying around as a screenshot. You can try out how codes are generated from a secret key in your browser with our 2FA code generator.
Why should you keep your recovery codes?
When you turn on 2FA, most sites give you a set of single-use recovery codes. If you lose your phone or can’t get into your authenticator app, these codes let you back into your account. You can add your recovery codes as a secure note to the matching item in your vault, or store them somewhere safe offline.
Should you keep 2FA codes in your password manager?
There are two schools of thought here, and both are reasonable:
- Keep them separate: Passwords in one place, 2FA codes in another app. If one is compromised, the other still protects you. This can be the right choice for accounts that need the highest level of assurance.
- Keep them together: The codes sit in the same end-to-end encrypted vault as your passwords, sync to all your devices and are filled in automatically. You won’t lose your codes if you lose your phone, and it becomes easier to turn on 2FA for more accounts.
In practice, the biggest risk for many people is never turning on 2FA at all. If you keep your codes in a password manager, protect the password manager account itself with a strong master password and a separate second factor.
How do you use 2FA with KeyZula?
KeyZula’s built-in 2FA authenticator is free, so you don’t need a separate authenticator app:
- Scan the site’s QR code straight from the page with the browser extension, or upload or paste an image of the QR code.
- Move all your accounts from Google Authenticator at once using its “Transfer accounts” QR codes.
- Fill in a code with one click; it also works with code fields split into separate boxes. After the password is filled in, the 2FA code is copied to your clipboard automatically (you can turn this off in the settings).
- On iOS and Android, reach your 2FA codes from inside apps too, through the system’s AutoFill.
- SHA-1, SHA-256, SHA-512 and Steam Guard codes are supported, and all codes sync encrypted across your devices.
You can also turn on two-step sign-in with an authenticator app for your KeyZula account itself and get a recovery code.
Frequently asked questions
Are 2FA and two-step verification the same thing?
In everyday use, yes. Two-step verification, two-factor authentication and 2FA all serve the same purpose: asking for a second piece of proof on top of your password.
If I lose my phone, how do I get to my 2FA codes?
If your codes only live in an app on that phone, you’ll need the recovery codes the sites gave you. In KeyZula, 2FA codes sync in encrypted form, so your codes come with you when you sign in to your account on a new device.
Can I switch from Google Authenticator to KeyZula?
Yes. In Google Authenticator, use “Transfer accounts” and upload a screenshot of the QR codes it creates to KeyZula. The image is decoded in your browser and your accounts are moved over in one go.
Is SMS-based 2FA safe?
It’s better than having no 2FA at all, but against SIM-swap fraud and phishing, an authenticator app, a security key or a passkey is a stronger option.