What is two-factor authentication?
Kahu team·Updated 2 Oct 2026·4 min read
Two-factor authentication, or 2FA, means logging in with something you know, your password, plus something you have, such as a code from an app or your phone. Even if someone steals your password, they cannot get in without the second step. Turn it on for email first.
How it works
A password alone can be guessed, reused from another breach or stolen by phishing. Two-factor authentication adds a second check when you log in, usually a short code or a tap on a device you own. You may also see it called two-step verification or multi-factor authentication. The idea is the same.
The main types
| Type | How it works | Strength |
|---|---|---|
| Text message code | A code sent by SMS | Better than nothing |
| Authenticator app | A code generated on your phone | Strong |
| Push approval | Tap to approve on your phone | Strong, if you only approve logins you started |
| Security key or passkey | A device or your phone confirms it is you | Strongest, and resists phishing |
Which accounts to protect first
- 1EmailWhoever controls your email can reset every other password.
- 2Banking and paymentsIncluding payment providers and accounting software.
- 3Your website and domainLosing these takes your business offline.
- 4Social mediaBusiness pages are often taken over and used for scams.
Turning it on for a team
Most business tools let an administrator require 2FA for every user. Turn that on, give people a week to set it up, and keep backup codes somewhere safe for the accounts that matter most. Remind the team that a real login prompt only appears when they are logging in themselves.
Where Kahu fits
Two Thursday gaps at 11:00 and 14:30. Drafted messages to 6 waitlisted customers.
Updated the hours on your site and Google profile to Sat–Sun 8–2.
One post about the new hours, using your Sunday counter photo.Frequently asked questions
Is 2FA the same as MFA?
Two-factor is multi-factor authentication with exactly two factors. In everyday use the terms mean the same thing.
What if I lose my phone?
Use the backup codes you saved when you set it up, or another sign-in method you added. Set these up before you need them.
Are text message codes safe?
They are much better than a password alone. An authenticator app or a passkey is stronger where the service offers one.