Understanding MFA, 2FA, OTP, and TOTP

Chances are you already use some form of multi-factor authentication - usually shortened to MFA - without giving it much thought. You sign in to your bank, enter your password, and then receive a text message or email with a six-digit code. Enter the correct code before it expires, and the bank grants access.

The “multi” in multi-factor authentication means using more than one factor, or method, to prove you are really you. Two-factor authentication, or 2FA, is simply MFA that uses two distinct factors. Good security practices include using a combination of something you know, like a password or PIN; something you bring, such as a phone or authenticator app; and something unique to who you are, like your face or fingerprint.

In the bank example, the password is something you know and the phone receiving the code is something you have – two different factors of authentication.

The six-digit codes are often called one-time passcodes, or OTPs, because each code can be used only once. Most OTPs received via text or email are deliberately short-lived, valid for only a few minutes, after which you need to request a new code.

A time-based one-time passcode, or TOTP, is a “rolling code” generated locally by an authenticator app such as Microsoft Authenticator, Google Authenticator, or Duo Mobile. These apps generate a new code at a regular interval, typically every 30 seconds. If you worked in an office in the early 2000s you might remember seeing “RSA SecureID” keyfobs on the desks in the accounting department – TOTPs are the same idea with a higher-tech keyfob.

Authenticator-app codes work even without internet or cellular service. You don’t need to receive a text message or email to see the code. As you add an account to the app, the website and the authenticator app are configured with the same secret value, typically using/scanning a QR code. From then on, each side uses that value and the current time to calculate the same temporary code, and the website grants access if the code you enter matches the code it expects. Internet or cellular connectivity is not involved in generating the code, but reasonably accurate timekeeping on all sides is important for successful authentication.

Using 2FA is a major improvement over using only a password. If someone learns your password, they still need the second factor before they can sign in. That extra step prevents many everyday account-takeover attempts.

However, code-based MFA is not perfect. A convincing fake website can trick someone into entering a username, password, and valid six-digit code. Text messages can be vulnerable if a criminal takes over your phone number or mobile account. Codes delivered through email can also be at risk if someone gains access to the email account itself. Many OTP methods aren’t “phish proof.”

Recognizing those shortcomings helped drive the development and adoption of passkeys. Passkeys are designed to work only with the legitimate website for which they were created. That makes them far more resistant to fake-site scams. Unlike a six-digit code, a passkey isn’t something a person can simply read over the phone or type into a scammer’s website. If your website or service supports passkey authentication, consider using it. And for accounts that do not yet offer passkey support, enable MFA ASAP, preferably with a dedicated password-manger or authenticator app.

Now, please go review the MFA settings configured for your email accounts, banks and financial institutions, social-media profiles, health and medical records, school websites, and don’t forget that your password manager itself should be protected by a strong, reliable form of MFA. Also enable MFA on your mobile-carrier account, which can help prevent someone from taking over your phone number. Business owners and IT staff should also enable MFA for their domain-registration providers and website hosts like GoDaddy, Wix, and Shopify.

If you are unsure whether a particular account has MFA enabled, try signing in through a private or incognito browser window. Don’t wait to start checking! MFA is one of the simplest and most effective steps you can take to protect your online life, identity, and reputation.