Two different kinds of proof: something you know (your passphrase) and
something you have (your phone).
Even if someone learns your password they still cannot get in, because the
six-digit code changes every 30 seconds and exists only on your phone.
You need an authenticator app:
- Google Authenticator —
Android ·
iPhone
- Any other TOTP app works too: Aegis, 2FAS, 1Password, Bitwarden.
Scan the square code once. The app then generates codes forever, even offline.