Multi-factor authentication, or MFA, requires more than one proof of identity to sign in. Typically that is something you know, such as a password, plus something you have, such as a code from an authenticator app, a text message or a hardware security key. Even if an attacker learns your password, they still need the second factor.
MFA blocks a large share of account takeovers, particularly those that rely on stolen or guessed passwords. It is one of the most effective protections an individual or organization can add, and it is often required by services handling sensitive data.
Not every MFA method is equally strong. Text messages can be intercepted or redirected through SIM swapping, and codes can be captured by phishing pages that relay them to the real site. Hardware security keys and passkeys resist phishing much better. MFA also does not protect against a stolen session token, because the token is issued after the second factor has been completed.
Use the strongest method your service supports, prefer security keys or authenticator apps to text messages, and store backup codes safely. Combine MFA with unique passwords, and revoke active sessions after a suspected compromise.