The authentication factors of two-factor authentication fall into three categories: something you know, something you have, and something you are; common implementations include TOTP, SMS verification codes, and hardware security keys (based on the FIDO2/WebAuthn standard).