Two-factor authentication
Also called: 2FA, MFA
Logging in with two proofs, usually a password plus a one-time code.
Definition
Two-factor authentication (2FA) adds a second step, such as a one-time code sent by SMS, a code from an authenticator app (TOTP) or a security key. MFA (multi-factor authentication) is the broader term for two or more factors. Testers check expired codes, wrong codes, resending, pasting the code and what happens if the user loses access to the second factor.
In practice
A bank app sends a 6-digit code by SMS. A code older than 5 minutes should be rejected, and "Resend code" should not be spammable.
Learn it in context
Lessons that use this term.
Related terms
- AuthenticationChecking who a user is, usually with a password, a code or biometrics.
- SessionThe period during which a user stays logged in without entering their credentials again.
- One-time password (OTP)A short code that works for one login and a short time, sent by SMS or email or generated by an app.
- TOTPTime-based one-time password: an authenticator app and the server compute the same code every 30 seconds.
- Backup codesSingle-use recovery codes shown when 2FA is set up, for when the phone is lost.