# What is two-step verification?

Two-step verification adds a second check after the password, like an app code or security key. Shared by a team, it no longer ties a sign-in to one person.

Updated: October 16, 2026

Two-step verification is a way of signing in that asks for a second check after the password.

## Is it the same as two-factor authentication?

Google's help center describes 2-Step Verification as extra protection for an account if the password is stolen, and treats it as another name for two-factor authentication. NIST gives the stricter definition. The glossary of SP 800-63B-4 lists three types of authentication factor. They are something you know (a password), something you have (a phone or a security key), and something you are (a fingerprint or face). Multi-factor authentication requires more than one distinct type.

## How do the methods differ?

There are four common kinds of second step. The table shows what each uses and how NIST SP 800-63B-4 treats it.

| Method | What you use | How NIST SP 800-63B-4 treats it |
| --- | --- | --- |
| Authenticator app | A short-lived code that an app on your phone makes | Allowed, but "OTP authentication is not phishing-resistant" (3.1.4) |
| Text message or voice call | A code sent to a registered phone number | Restricted: allowed only with extra conditions (3.1.3.3) |
| Email | A code sent to an email address | Not allowed as a channel for sign-in codes (3.1.3.1) |
| Security key or passkey | A physical key, or a cryptographic key kept on your device | Can be phishing-resistant, which requires cryptographic authentication (3.2.5) |

Phishing here means a fake sign-in page that tricks you into typing your password and code.

Authenticator app codes follow RFC 6238, the standard for time-based one-time passwords (TOTP). The service and the app hold the same secret key, and each works out the code from the current time. So the code is made on the device that holds the key, not sent to it. By default a new code comes every 30 seconds.

## What happens when a team shares one?

The second step assumes one person holds it. In its appendix on syncable authenticators, NIST SP 800-63B-4 notes that guidelines have long warned against sharing authenticators, and that "different users are expected to maintain their own unique authenticators." A shared account breaks that assumption in two ways.

First, the second step lives in one place. The app's secret key sits on the registered phone, texts go to the registered number, and a security key stays with one person. When that person is out, nobody else can sign in. Some apps, such as Google Authenticator, sync codes across devices, but only to devices signed in to the same Google Account.

Second, sharing hides who signed in. If everyone scans the setup QR code into their own phone, the second step proves only that someone with the key signed in. It no longer points to a person.

[Managing shared accounts](/guides/shared-accounts) compares ways to run these accounts.


## Frequently asked questions

**Is two-step verification the same as two-factor authentication?**

In everyday use, yes. Strictly, two-factor means two different types of factor, such as something you know and something you have. NIST SP 800-63B-4 defines multi-factor authentication that way.

**Can everyone on the team add the shared account to their authenticator app?**

Every phone that scans the setup QR code shows the same codes, but then you can't tell who signed in. NIST expects each user to keep their own authenticator.

**Should we stop using text message codes?**

Where the service offers another option, yes. NIST SP 800-63B-4 restricts codes sent by text or voice call. An authenticator app doesn't rely on the phone network. Of the common methods, only a security key or passkey can resist phishing.

## Sources

- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [IETF RFC 6238: TOTP, Time-Based One-Time Password Algorithm](https://datatracker.ietf.org/doc/html/rfc6238)
- [Google Account Help: Turn on 2-Step Verification](https://support.google.com/accounts/answer/185839?hl=en)
- [Google Account Help: Get verification codes with Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** With Junify, each person verifies on their own phone before opening a shared account, so each use is recorded by person even when two-step verification is shared. If the account uses an authenticator app, Junify enters the code, so signing in doesn't depend on one person's phone. Codes sent by text message or email aren't covered.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=what-is-two-step-verification)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.