Two-factor authentication adds a second verification step even if someone has your password.
Even if an attacker steals your password — through a phishing attack, a data breach, or guessing — 2FA blocks them because they do not have your second factor. They would need both your password and physical possession of your phone or security key.
There are three types of 2FA, in increasing order of security: SMS codes (a text message with a 6-digit code), authenticator apps (an app that generates time-limited codes without needing a network connection), and hardware security keys (a physical USB or NFC device that cryptographically proves your identity).
SMS-based 2FA is better than nothing but has a known weakness: SIM swapping. An attacker convinces your phone carrier to transfer your number to a SIM they control, then receives your SMS codes. Authenticator apps and hardware keys are immune to this attack.
When you enable 2FA on an account, save the backup codes the service provides. Store them in your password manager or print them and keep them secure. These allow you to recover access if you lose your phone.