This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of October 21, 2026. Spotted a mistake? Tell us.
Multi-factor authentication (MFA) requires two or more independent kinds of proof before someone can sign in. A stolen password alone is then not enough: the attacker would also need the user's phone, security key or fingerprint.
Two-factor authentication (2FA) is MFA with exactly two factors, which is by far the most common case: a password plus a code from an app, for example.
The three factor types
| Factor | Examples |
|---|---|
| Something you know | Password, PIN, security question |
| Something you have | Phone with an authenticator app, security key, a phone number that receives SMS |
| Something you are | Fingerprint, face recognition |
MFA means factors of different types. A password plus a security question is two things you know, so it isn't real MFA.
MFA methods compared
| Method | How it works | Phishing-resistant | Friction |
|---|---|---|---|
| SMS code | A one-time code sent by text message | No; also exposed to SIM swapping | Low |
| Email code or link | A one-time code or link sent by email | No | Low |
| TOTP app | An app such as Google or Microsoft Authenticator generates a code every 30 seconds (RFC 6238) | No: a fake site can ask for the code | Medium |
| Push approval | Approve a sign-in in a mobile app | No; exposed to "push fatigue" | Low |
| Passkey or security key | Public-key signature bound to the real site (WebAuthn / FIDO2) | Yes | Low |
Phishing-resistant MFA means a method a fake login page can't relay. Codes typed by the user can be relayed in real time; WebAuthn credentials are bound to the site's origin, so they don't work on a look-alike domain. CISA and NIST guidance treat FIDO2 / WebAuthn as the phishing-resistant option.
Rolling out MFA
- Offer several methods, so everyone has one that works: an authenticator app, passkeys, and SMS or email as a fallback.
- Give recovery codes at setup, so a lost phone doesn't mean a lost account.
- Require it where it matters first: administrators, then employees, then customers' sensitive actions.
- Limit failed attempts on codes as you do on passwords.
- Reduce prompts without reducing security: remember trusted devices for a period, and move users toward passkeys.
MFA with Casdoor
Casdoor is an open-source identity provider with MFA built in: TOTP authenticator apps, SMS and email codes, and RADIUS as a second factor, plus passkeys and security keys through WebAuthn. Every method comes with recovery codes. Administrators choose per organization whether each method is optional, prompted after sign-in, or required, and can let users skip the second factor on a trusted device for a set time. Wrong codes count against the application's failed sign-in limit.
Because Casdoor is the identity provider for your apps over OIDC, SAML, CAS, LDAP and RADIUS, turning MFA on there protects every connected app. Self-host it for free, or run it on Casdoor Cloud from $24/month billed yearly. See also What are passkeys and What is SSO.
FAQ
Is 2FA the same as MFA? 2FA is MFA with two factors. In practice the terms are used interchangeably.
Is SMS 2FA still worth using? It's much better than a password alone, but it's the weakest option because of SIM swapping and phishing. Offer an authenticator app or passkeys as well.
Are passkeys MFA? A passkey combines something you have (the device holding the key) with a local check of something you are or know (biometrics or the device PIN), so a single passkey sign-in is generally treated as multi-factor.
What if a user loses their phone? They sign in with one of the recovery codes they saved at setup, then set up MFA again on the new phone.
Sources
- NIST SP 800-63B
- RFC 6238: TOTP
- W3C Web Authentication
- CISA: Implementing phishing-resistant MFA
- Casdoor docs: MFA
- Casdoor docs: Require MFA
Product names are trademarks of their respective owners.