2FA (two-factor authentication)
Signing in with a second proof beyond the password, such as a code from an authenticator app or a passkey, so a leaked password alone isn't enough.
Updated October 2026 · with examples from our own builds
What does 2FA mean in practice?
Two-factor authentication pairs something you know, the password, with something you have: an authenticator app generating time-based codes, a passkey on your device or a hardware key. For accounts with power, such as admin and finance staff, it is the most effective single control.
The real decision is where to require it. Customers may get it as an option; staff who can refund money, read private data or change settings shouldn't be able to opt out, and high-risk actions can ask for a fresh code even inside a signed-in session.
Recovery paths and enforcement are its weak points. Every bypass, such as a reset by email or a skipped check on one route, deserves as much scrutiny as the login itself.
2FA at a glance
- Methods
- Authenticator codes (TOTP), passkeys and security keys
- Make it mandatory for
- Staff with access to money, data or settings
- Review
- Recovery paths and every route that should check it
Where has 2FA come up in our builds?
All nine staff roles require two-factor sign-in: TOTP, with WebAuthn passkeys required after a 90-day enrolment window. Crypto-shred, feature-flag kill switches and break-glass grants need a fresh code, and a review of our own code found the break-glass check had been mounted as the middleware factory instead of being called, which silently skipped it; it is fixed.
App discovery signs in with a demo account that has no two-factor prompt. If the login page asks for a code or shows a captcha, the run stops and says so; it never tries to get past either.
Common questions about 2FA
Should my customers be forced to use 2FA?
For most consumer apps, offer it rather than force it. For staff and admin accounts, require it, and ask for a fresh code before actions that move money or delete data.
Are SMS codes good enough as a second factor?
Better than nothing, but weaker than authenticator apps or passkeys, because phone numbers can be hijacked. Use authenticator codes or passkeys for staff accounts.
Related terms
Sources
Planning a product and not sure where 2FA fits? Ask us, or browse all 116 terms in the glossary.