What are 2FA and MFA
A second independent factor limits the harm from password disclosure. Two passwords do not make two factors.
MFA, passkeys, and keys
Stronger sign-in and account recovery methods.
Passkeys: phishing-resistant sign-in
A passkey uses cryptography bound to the legitimate domain, so it does not reveal a secret to a fake site.
Physical security keys
A FIDO key can protect critical accounts from phishing, but requires a backup and storage plan.
How to store recovery codes
Recovery codes are emergency keys to an account. Do not store them beside the password or in a public note.