A second factor is the extra proof required after a password to verify a user’s identity. Common examples include a one-time code from an authenticator app, a push approval, a hardware security key, or a biometric check. It matters because a stolen password alone should not be enough to enter an account.
In cyber security, second factors are a core part of multi-factor authentication, but their strength varies. SMS codes are better than passwords alone, yet they can be intercepted or abused through social engineering and SIM swapping. More resistant options, such as hardware tokens or phishing-resistant cryptographic keys, make it much harder for attackers to replay credentials. Defenders also need to protect enrollment and recovery flows, because criminals often target those paths when they cannot defeat the login prompt directly.