Why Single-Factor Passwords Are Never Enough
A leaked password database, credential-stuffing script, or phished login renders a single password useless. Two-factor authentication (2FA) demands a second, independent proof of identity before granting session access.
The Three Classical Authentication Factors
- Something You Know (Knowledge): Passwords, PINs, or passphrase answers.
- Something You Have (Possession): An authenticator holding a TOTP seed, a physical FIDO2 USB security key, or a SIM card.
- Something You Are (Inherence): Biometric fingerprints, Face ID, or iris verification.
True two-factor authentication combines two distinct categories (for example, your password + a TOTP code from an authenticator). Requiring both a password and a security question does NOT count—both belong to the knowledge category.
Where Authenticator Apps & TOTP Fit
Authenticator apps turn either your smartphone or your Chrome browser into a possession-based OTP generator. During login: (1) you submit your username and password; (2) the server prompts for a 6-digit temporary passcode; (3) you retrieve the matching RFC 6238 code computed locally on your device; (4) the server validates both the password hash and the active time window before issuing an authenticated cookie.
App-generated TOTP codes calculate locally without carrier networks, removing SIM-swap interception risks and cellular dead-zone delays.
Explore how to bring this standard directly into your browser workflow on our Secure TOTP Authenticator hub or compare time-based vs counter-based protocols next.
