Term · Data, privacy & security
Two-factor authentication (2FA)
With two-factor authentication, your password alone is not enough to log in. You also confirm with a code, your phone or a key.
In short
Two-factor authentication (2FA, also MFA) is logging in with your password plus an extra step, such as a code from an app or your fingerprint. If someone knows your password, that alone does not get them in. Start with your email and with the accounts that hold business data.
What is two-factor authentication?
Two-factor authentication is a way of logging in in which, besides your password, you give a second proof that it is you. For example, a code from an app on your phone.
Other names are two-step verification, multi-factor authentication, 2FA and MFA. They are about the same idea.
How does two-factor authentication work?
You log in with your password. Then the system asks for a second step. That can be:
- a code from an authenticator app;
- a notification on your phone that you approve;
- a code by text message;
- your fingerprint or face recognition;
- a hardware key: a small device that you plug into your laptop.
A text message is less secure than an app, because an attacker can intercept a text message. Still, a text message is better than just a password. 2FA is not watertight: via a fake website, someone can also steal a code. But a password that leaked elsewhere in a data breach is not enough on its own with 2FA.
Example in an SME
Example
Say your business works with Microsoft 365 or Google Workspace. As an administrator, you can make two-factor authentication mandatory for all employees there. Employees then set up their second step once, for example an app on their phone. After that, the system asks for the extra step, for example when someone logs in on a new device.
Where do you start with two-factor authentication?
- With your email. With your email, someone can often reset the passwords of your other accounts.
- With accounts that hold business data. Think of your accounting, your CRM and the admin accounts of your systems.
- Arrange recovery. Keep recovery codes in a safe place, for when a phone breaks or is lost.
For integrations between systems, access works differently. There you use OAuth or an API key. Having software built? Then also ask how users log in. Read how I approach custom software.
Frequently asked questions
Is 2FA the same as MFA?
Almost. MFA means two or more steps, 2FA exactly two. In practice the words are used interchangeably.
What if I lose my phone?
Then you need a recovery plan. Many apps work with recovery codes. Write them down and keep them safe. Without recovery you can lock yourself out.
Sources: Chamber of Commerce (KvK): An extra lock on your accounts: how do you start with 2FA? (in Dutch), Microsoft: Security defaults (in Dutch) and Google Workspace: Deploy 2-Step Verification (in Dutch). Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 7 October 2026
Read more
Term
OAuth
OAuth lets an app or integration access your data in another system, without you sharing your password. How it works, and what to look out for.
Read moreTerm
Data breach (datalek)
A data breach is unintended access to personal data, or its loss. What do you do then, and when do you report it to the Dutch Data Protection Authority?
Read moreTerm
API key
What is an API key? A secret code that gives software access to another system. How it works, and how to handle it safely.
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.