What Is Two-Factor Authentication (and Why It Keeps Logging You Out)
Two-factor authentication — usually shortened to 2FA, or sometimes called two-step verification — is the single biggest thing that stops someone from getting into your email even if they somehow got your password. It's also, understandably, the source of a lot of frustration when it seems to be working against you instead of for you.
What it actually is
Normally, signing in needs one thing: your password (something you know). 2FA adds a second, different kind of proof — something you have, usually your phone. That second factor might be a text message code, a push notification you approve, or a code from an authenticator app.
The reason this matters: a leaked or guessed password alone isn't enough to get in anymore. Someone would also need your phone, or access to your authenticator app.
Why it sometimes locks out apps that used to work fine
Older email apps and desktop clients often have no way to display that second prompt — they were built before 2FA was common. So instead of failing outright, most providers issue a separate app password: a one-time-generated password used only by that specific app, which bypasses the 2FA prompt for that app alone while leaving your main account protected.
This is why "my password is definitely right but the app won't log in" so often turns out to be a 2FA-related issue, not a typo.
Common friction points
- Verification code never arrives — usually a phone number on file that's outdated, or a signal issue. Authenticator apps tend to be more reliable than SMS for this reason.
- Codes get rejected even though they look right — often a device clock that's drifted out of sync. Authenticator app codes are time-based; a few minutes of clock drift breaks them.
- Lost the phone 2FA is tied to — this is exactly what backup/recovery codes are for. Most providers show these once, when you first set up 2FA, with instructions to save them somewhere safe. If you never saved them, account recovery is still possible but takes longer.
Should you turn it on?
Yes, for email specifically — your inbox is often the recovery path for every other account you own (password resets for banking, shopping, social media all go through email). Protecting it with 2FA has an outsized effect on your overall security compared to almost anything else you could do.