Home / Glossary / MFA (Multi-Factor Authentication)

MFA (Multi-Factor Authentication)

SFBy Sitraka Forler · Lecturer, Durham Business School·Updated 13 September 2026· About this site

Proving who you are with two or more different kinds of evidence, not just a password.

Factors must come from different categories: something you know (a password), have (a phone or security key) or are (a fingerprint), so a password plus a security question is not MFA. A leaked password alone then unlocks nothing; two-factor authentication (2FA) is MFA with exactly two. Text-message (SMS) codes can be hijacked, authenticator apps are safer, and passkeys and security keys resist phishing.

# pip install pyotp
import pyotp

# A time-based one-time password (TOTP) generator, like an authenticator app
totp = pyotp.TOTP(pyotp.random_base32())  # the random secret is what the app stores
print(totp.now())  # a 6-digit code that changes every 30 seconds