Definition
Two-Factor Authentication, also called 2FA or multi-factor authentication (MFA), requires the user to present two pieces of evidence to log in: typically something they know (a password) plus something they have (a phone, hardware key) or something they are (fingerprint, face). The point is that an attacker who steals one factor (the password, by phishing or breach) cannot log in without also obtaining the second.
Common 2FA Methods
Time-based one-time passwords (TOTP) generated by apps like Google Authenticator, Authy, or 1Password — the standard, well-supported choice. SMS codes sent to a phone — easy but vulnerable to SIM-swap attacks and phishing relays. Push notifications to a trusted device — convenient but depend on the platform. Hardware security keys using FIDO2/WebAuthn — the strongest option, immune to phishing because the key cryptographically verifies the site. Email-based codes are weakest, since email itself often lacks 2FA.
VPNs and 2FA
Most reputable consumer VPN providers offer 2FA on the account login. Enterprise VPN gateways nearly always require it. The threat model is account takeover: an attacker who acquires your VPN credentials (from a data breach or phishing) could connect, see your real IP via the provider's logs, or run malicious activity attributed to your subscription. 2FA breaks that chain. Hardware keys are the gold standard; TOTP is a strong alternative; SMS should be avoided where possible.