# What is multi-factor authentication (MFA)?

Source: https://www.plutonapps.com/resources/what-is-multi-factor-authentication

Published 2026-09-30, updated 2026-10-24, sources checked 2026-10-24. By Irfan Habib (https://www.plutonapps.com/authors/irfan-habib).

**Multi-factor authentication (MFA):** Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof: something you know, such as a password, something you have, such as a phone, or something you are. A stolen password alone is then not enough to get in.

Also known as: MFA, Two-factor authentication, 2FA.

The single most effective control against stolen passwords, and one of the first questions on a security review.

## What does MFA stop that a password alone cannot?

Your users reuse passwords, and some of those passwords are already in leaked lists. MFA is what stops a reused password from becoming a breached account. For your own team, it matters even more: an admin account or a database dashboard without MFA is the easiest way into everything.

## Which MFA methods are strongest, and which are weakest?

Not all second factors are equal. NIST's current guidance, SP 800-63B-4, classes codes sent by SMS or voice call as restricted, and says manually typed codes, including authenticator app codes, are not phishing-resistant. Passkeys and security keys that use cryptographic authentication bound to the real site are the strongest option it describes.

| Method | What it is | Main weakness |
| --- | --- | --- |
| SMS or voice code | A code sent to a phone number | SIM swaps and number porting; NIST lists it as restricted |
| Authenticator app (TOTP) | A code that changes every 30 seconds | Can be typed into a phishing page |
| Passkey or security key | A cryptographic key tied to the site | Needs a backup plan if the device is lost |

## Which accounts should require MFA first?

Start with the accounts that could do the most damage. First every account your team uses to run the product, such as hosting, database, code repository, email and payments; then admin roles inside your own app; then customer accounts holding money, health or other sensitive data, with MFA optional for everyone else.

1. Every account your team uses to run the product: hosting, database, code repository, email, payments.
2. Admin roles inside your own app.
3. Customer accounts that hold money, health or other sensitive data, then everyone else as an option.

Auth providers such as Clerk offer MFA as a setting, so for your users it is mostly a product decision. For your team's accounts it is a checklist, and security reviews will ask to see it done.

## How do you require MFA in a Supabase or Lovable app?

Supabase Auth supports authenticator app codes and phone codes. After a normal sign-in a session is at assurance level aal1; once the user passes a second factor it becomes aal2, and that level is written into the session token's aal claim. You can then make the database itself refuse sensitive rows to aal1 sessions.

- Turn on the MFA methods you want in the Supabase dashboard and build the enrol and verify screens.
- Add a restrictive policy that checks (select auth.jwt()->>'aal') = 'aal2' on sensitive tables. Supabase notes a token without the claim counts as aal1.
- Choose who must use it: everyone, new users after a date, or users who have already enrolled a factor.

Hiding a screen until MFA is done is not enough on its own; the check has to sit where the data is, the same rule as in [authentication vs authorization](https://www.plutonapps.com/resources/authentication-vs-authorization). If you use Clerk, its reverification feature asks a signed-in user to verify again before sensitive actions such as changing a password or removing MFA. Our [Lovable security checklist](https://www.plutonapps.com/guides/lovable-security-checklist) lists the other sign-in checks, and the [production readiness check](https://www.plutonapps.com/tools/production-readiness-check) gives a quick read on your app.

## Frequently asked questions

### What is the difference between MFA and 2FA?

2FA uses exactly two factors. MFA means two or more. In everyday use the terms are often interchangeable. Either way, the factors must be different kinds of proof: something you know, such as a password, something you have, such as a phone, or something you are.

### Can MFA be bypassed?

Weaker forms can, for example SMS codes through SIM swapping or phishing pages that relay codes. Authenticator apps, passkeys and security keys are much harder to defeat. Even the weaker forms mean a stolen password alone is no longer enough to sign in.

### Is SMS a safe second factor?

It is better than a password alone, but it is the weakest common option. NIST SP 800-63B-4 classes SMS and voice codes as restricted and says verifiers should check for signs such as a recent SIM change. Offer an authenticator app or passkey where you can.

### Are passkeys a form of multi-factor authentication?

A passkey is a cryptographic key kept on a device and usually unlocked with a fingerprint, face or PIN, so it combines something you have with something you are or know. NIST treats this kind of cryptographic authenticator as phishing-resistant, which typed one-time codes are not.

## Sources

- [CISA: More than a password (multifactor authentication)](https://www.cisa.gov/MFA)
- [OWASP Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html)
- [NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [Supabase docs: Multi-Factor Authentication](https://supabase.com/docs/guides/auth/auth-mfa)
- [Clerk docs: Reverification](https://clerk.com/docs/guides/secure/reverification)