How Does Two-Factor Authentication Actually Work in 2026?

In 2011, RSA Security admitted that attackers had breached its networks and stolen information related to its SecurID two-factor authentication tokens. The breach was serious enough that Lockheed Martin, a defense contractor that relied on SecurID, reportedly suffered a related intrusion shortly after. RSA replaced millions of tokens at no charge.

The episode is a useful reminder. Two-factor authentication raises the cost of an attack, but it is not a magic shield. The strength depends entirely on which second factor you use and how it is implemented.

The most common second factor today is a six-digit code that refreshes every 30 seconds, generated by an app like Google Authenticator or Authy. That code is a TOTP, a Time-based One-Time Password defined in RFC 6238. You can generate one yourself with the TOTP generator and watch the countdown tick.

Two-factor authentication combines two different authentication factors from distinct categories. The three categories are: something you know (a password or PIN), something you have (a phone, hardware token, or security key), and something you are (a fingerprint, face scan, or other biometric).

Using two passwords is not 2FA. Both are "something you know," which means they are the same factor type. An attacker who phishes one can phish the other. The point of combining factors is that compromising two different categories is harder than compromising one category twice.

A password plus a TOTP code from your phone is genuine 2FA. The password is something you know. The phone generating the code is something you have. An attacker needs both to log in.

The terminology gets muddy in practice. Many services label any secondary prompt as "2FA," including email verification links and push notifications. These add friction, but they vary in how much actual security they provide. A push notification that asks "Was this you?" can be defeated by social engineering or notification fatigue. The factor type matters more than the label.

TOTP is the algorithm behind those six-digit codes in authenticator apps. It is defined in RFC 6238, published in 2011, and it builds on HOTP, the HMAC-based One-Time Password algorithm defined in RFC 4226 from 2005.

Here is how it works. When you enable 2FA on a service, the server generates a random shared secret (typically 160 bits) and encodes it as a QR code. You scan it with your authenticator app, which stores the secret locally. Both the server and your app now hold the same secret.

To generate a code, both sides compute HMAC-SHA-1 using the shared secret as the key and a time-based counter as the message. The counter is derived from the current Unix time divided by a time step, usually 30 seconds. The HMAC output is truncated to six digits. If your phone's clock and the server's clock agree, you both produce the same six-digit code for the same 30-second window.

The math is straightforward:

counter = floor(current_unix_time / 30) hmac = HMAC-SHA-1(secret, counter) code = truncate(hmac) mod 10^6

The server accepts the code if it matches within a small window (typically plus or minus one time step) to account for clock drift. To prevent code reuse, the server records the timestamp of the last accepted code and rejects any code from an earlier window.

You can experiment with the underlying HMAC computation using the HMAC generator, which lets you see how a secret and a message produce a fixed-length output. The SHA-1 variant is what TOTP uses under the hood, and you can compare it against the SHA-256 hash generator to see how different hash functions produce different outputs for the same input.

SMS is the most widely deployed second factor, and it is also the weakest. The problem is not the code itself. The problem is the delivery channel.

SMS messages can be intercepted through SIM-swap attacks, where an attacker convinces your mobile carrier to port your phone number to a SIM card they control. Once the port completes, every SMS, including your 2FA codes, goes to the attacker's device. SIM-swap attacks have been used to compromise cryptocurrency accounts, bank accounts, and social media profiles. In 2019, Twitter CEO Jack Dorsey's own account was hijacked via a SIM swap.

SMS is also vulnerable to SS7 interception. The Signaling System 7 protocol routes SMS messages between carriers, and it has known vulnerabilities that allow attackers on the global telephony network to intercept messages without touching the victim's phone.

NIST SP 800-63B, the U.S. government's authentication guidelines, explicitly discourages the use of SMS for high-assurance authentication. The publication notes that out-of-band verification using SMS is restricted and should not be used for new applications at the highest assurance levels.

If a service offers TOTP or a security key as an alternative to SMS, take it. TOTP codes are generated locally on your device and never traverse a telephony network.

FIDO2 is the strongest mainstream 2FA option available. It is phishing-resistant by design, and it is based on public-key cryptography rather than shared secrets.

When you register a FIDO2 credential (a security key like a YubiKey, or a passkey on your phone), the device generates a key pair and sends the public key to the service. The private key never leaves the device. On login, the server sends a challenge. The device signs the challenge with the private key and returns the signature. The server verifies it with the public key.

The phishing resistance comes from origin binding. The browser passes the exact domain (origin) to the authenticator during the signing operation. If you are on evil-phishing-site.com instead of real-site.com, the authenticator refuses to sign because the origin does not match the one registered. The attacker cannot relay the challenge to a real device because the origin check fails locally on the authenticator.

WebAuthn is the browser API standard, published as a W3C Recommendation. CTAP (Client to Authenticator Protocol) is the companion standard defined by the FIDO Alliance that governs communication between the browser and the hardware authenticator.

Passkeys are the latest evolution: synced discoverable credentials that move between your devices through cloud sync (iCloud Keychain, Google Password Manager). They use the same WebAuthn protocol but eliminate the need to carry a physical key. Adoption has grown rapidly through 2026 as major platforms shipped passkey support by default.

Not all second factors are equal. Here is how the common methods compare on the dimensions that matter.

TOTP sits in the middle. It is not phishing-resistant because a user can be tricked into typing a code on a fake site. But it eliminates the telephony attacks that plague SMS. For most people, TOTP is the right balance of security and convenience.

FIDO2 and passkeys are strictly better on security. The tradeoff is ecosystem support: not every service supports WebAuthn yet, and hardware keys cost money. Passkeys are closing the convenience gap by removing the hardware requirement.

One more thing. Recovery codes matter. When you enable 2FA, the service gives you backup codes to use if you lose your second factor. Store them offline. If you lose your phone and your recovery codes, you are locked out. Some services offer account recovery through identity verification, but that process can take days and is not guaranteed.

Two-factor authentication works by requiring evidence from two different factor categories, not by doubling up on the same one. TOTP, defined in RFC 6238, generates time-based codes from a shared secret and HMAC-SHA-1. FIDO2 and passkeys go further by using public-key cryptography with origin binding, making them phishing-resistant in a way TOTP and SMS cannot match.

SMS remains the most common and the weakest option, vulnerable to SIM-swap and SS7 attacks. If your accounts offer TOTP or a security key, switch to it. You can see exactly how a TOTP code is produced by trying the TOTP generator with your own secret and time step.