A password is only one piece of evidence that you are who you say you are. If someone steals, guesses, or tricks you into entering it, multi-factor authentication (MFA) can add another check before an account opens. Here is what MFA does, where its limits are, and how to choose a method.
Why one password is not enough
Passwords can be reused across sites, exposed in a data breach, guessed, or captured by a convincing fake sign-in page. A unique, long password stored in a password manager helps, but it cannot by itself stop every kind of account takeover. MFA asks for an additional proof, so a password alone is less likely to be enough for an attacker.
What counts as a second factor?
Factors are usually grouped as something you know, such as a password; something you have, such as a security key; and something you are, such as a biometric check performed by your device. Two passwords are still the same factor type. Authenticator-app codes are another option, but they can still be phished if you type one into a convincing impostor site.
Which method should you choose?
When available, choose a passkey or hardware security key. These phishing-resistant options bind sign-in to the legitimate service, making ordinary look-alike phishing pages much less effective. Follow the service's setup and recovery instructions, and register a backup method where possible.
Authenticator-app codes are generally a useful alternative when passkeys or security keys are unavailable, but never share a code or enter one after following an unexpected link. SMS codes are more exposed to phone-number takeover and interception; if SMS is the only option, it is still usually better than leaving an important account protected by a password alone.
A safer setup checklist
Start with your primary email, password manager, financial accounts, and social accounts. Turn on the strongest MFA method each service supports. Save recovery codes somewhere private and separate from your sign-in device. Keep your recovery email and phone number current, deny unexpected sign-in prompts, and continue using unique passwords.
MFA helps, but it is not a guarantee
MFA can reduce the impact of a compromised password, but it does not replace unique passwords, device updates, or careful account recovery. Attackers may still target recovery processes, devices, or people. Review sign-in alerts and remove old devices or methods you no longer use.
Enable MFA on important accounts today. Choose phishing-resistant sign-in when available, and make sure you can recover the account safely.
Further reading
CISA: Multi-Factor Authentication (MFA) · NIST SP 800-63B: Authentication and Authenticator Management