A password plus a cryptographic security key is MFA; two passwords are not, because they use the same factor type.
MFA reduces the value of a stolen password, but methods provide different levels of protection. Codes sent by text or generated by an app can still be phished or intercepted. Cryptographic authenticators bound to the legitimate service — such as FIDO security keys and properly implemented passkeys — provide stronger resistance to phishing.
Key points
Knowledge factorPassword, passphrase, or PIN.
Possession factorSecurity key, authenticator device, smart card, or registered device.
Inherence factorA biometric characteristic, normally used to unlock or activate an authenticator rather than serve as a secret.
Operational needSecure enrollment, recovery, device replacement, and help-desk verification are part of the control.
Important limitationMFA does not prevent every account takeover; session theft, malicious consent, weak recovery, and real-time social engineering can bypass some implementations.