ISC Authentication · Updated November 2026
Does Two Passwords Count as Two-Factor Authentication?
Multiple credentials are not necessarily multiple factors. The factors must come from different categories.
Something you know
Examples include passwords, PINs, and security answers.
Something you have
Examples include hardware tokens, authenticator devices, and smart cards.
Something you are
Examples include fingerprints, facial recognition, and other biometrics.
MFA
MFA combines two or more distinct factor categories. Password plus PIN is still knowledge plus knowledge.
The takeaway
Two passwords are two credentials, not two factors.
Related Summit guides
FAQ
Are password and PIN two factors?
No.
Is fingerprint a possession factor?
No. It is biometric.
Does MFA eliminate compromise risk?
No, but it can reduce it.