# What is Multi-Factor Authentication (MFA)?

> Multi-factor authentication (MFA) verifies a user with factors from at least two different categories: something the user knows, something the user possesses, or something the user is.

- Canonical URL: https://yellowcube.eu/glossary/multi-factor-authentication/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A password plus a cryptographic security key is MFA; two passwords are not, because they use the same factor type.

MFA reduces the value of a stolen password, but methods provide different levels of protection. Codes sent by text or generated by an app can still be phished or intercepted. Cryptographic authenticators bound to the legitimate service — such as FIDO security keys and properly implemented passkeys — provide stronger resistance to phishing.

### Key points

- **Knowledge factor:** Password, passphrase, or PIN.
- **Possession factor:** Security key, authenticator device, smart card, or registered device.
- **Inherence factor:** A biometric characteristic, normally used to unlock or activate an authenticator rather than serve as a secret.
- **Operational need:** Secure enrollment, recovery, device replacement, and help-desk verification are part of the control.
- **Important limitation:** MFA does not prevent every account takeover; session theft, malicious consent, weak recovery, and real-time social engineering can bypass some implementations.

### Related terms

[Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Passwordless authentication](<https://yellowcube.eu/glossary/passwordless-authentication/>) · [Passkey](<https://yellowcube.eu/glossary/passkey/>) · [Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Zero trust network access (ZTNA)](<https://yellowcube.eu/glossary/zero-trust-network-access/>) · [Adversary-in-the-middle (AiTM) phishing](<https://yellowcube.eu/glossary/adversary-in-the-middle-phishing/>)

### Sources

[NIST glossary: Multi-Factor Authentication](https://csrc.nist.gov/glossary/term/Multi_Factor_Authentication) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.