So suppose I don't have a phone (or lose it), and I need to do 2fa on an app. I DO always have access to a few email accounts, but I can't seem to find any tricks to have the 2fa go through an email address instead. Results very hard to sift through.

  • Not sure what you are asking: Are you asking if using email as a 2FA makes sense - see for example Email for the second factor in 2FA systems. Are you asking if a specific identity provider or SDK supports this - check the specific documentation. Commented Aug 26, 2021 at 4:20
  • 2
    Its possible to get a 2fa application for the computer as well as a phone. An open source example of this can be found here: winauth.github.io/winauth Commented Aug 26, 2021 at 4:31
  • Perhaps take a look at Authy which works on desktop (plus mobile) and syncs to the cloud.
    – Harrison G
    Commented Aug 26, 2021 at 4:32

1 Answer 1


Email is almost always secured by "a thing you know" (password), and thus in context is the same kind of factor as the first factor on the web site (also password). This fails the goal of 2FA that the two factors should be of different types:

  • thing you know (memorized secret e.g. password)
  • thing you have (e.g. phone with an app, physical security token, paper with a key written on it, physical key)
  • thing you are (biometric e.g. fingerprint or iris scan)

In practice, of course, most people have their phone automatically sync their email, so email access indicates either a thing you know or a thing you have. However, being two kinds of factors at once (via an "or") is worse than being only one.

In any case, email is usually a valid first factor (via "magic link" or password reset as an alternative to passwords) but I've never seen it used as a second factor, and the only way that would be "proper" 2FA is if the first factor was something like a biometric.

  • is the same kind of factor as the first factor on the web site (also password) Not if the email provider has proper 2FA of its own.
    – John Wu
    Commented Jan 23, 2022 at 6:15
  • @JohnWu Sure, but you can't expect that users have set up 2FA on their email - most don't - so it wouldn't make sense for a website to offer it as a second factor. (In practice of course lots of sites will send you a "verification email" if they detect a suspicious login, for widely varying thresholds of "suspicious", but in most cases this isn't going to meet the technical standard of 2FA and it isn't advertised as such.)
    – CBHacking
    Commented Jan 23, 2022 at 22:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .