What is Multi-Factor Authentication (MFA)?
Requiring two or more independent proofs of identity — something you know, have, or are — before granting access.
Definition
MFA strengthens login by demanding factors from different categories: something you know (password), something you have (phone, hardware key), something you are (fingerprint). Even a phished password fails without the second factor. Methods vary widely in strength: SMS codes are vulnerable to SIM swapping; TOTP apps like Google Authenticator generate time-based codes from a shared secret (RFC 6238); push approvals are convenient but phishable via fatigue attacks; FIDO2/WebAuthn hardware keys such as YubiKeys are phishing-resistant because the browser binds the challenge to the site's origin. Passkeys extend WebAuthn into a passwordless flow.