In more detail
The factors are something you know (password), something you have (phone, hardware key) and something you are (fingerprint, face). A stolen password alone is then not enough. App-generated one-time codes (TOTP) beat SMS codes, which can be intercepted; hardware keys and passkeys also resist Phishing. A TOTP code is derived from a shared secret and the current time, in steps of 30 seconds, so it changes every half minute and is useless once it expires. Try a one-time code generator with the TOTP Generator.
Why it matters
Most account takeovers start with a password that was reused, guessed or leaked. A second factor stops the attacker who has only the password, including bulk attempts such as Brute-force attack and credential stuffing. But not every factor is equal. SMS codes can be diverted by SIM swapping, one-time codes can be relayed by a convincing fake login page, and approval prompts can be worn down by repeated requests. Phishing-resistant methods (hardware keys, passkeys) check the real website address, so a look-alike page gets nothing. Keep recovery codes somewhere safe, or you may lock yourself out.
Example
TOTP (RFC 6238) takes the current Unix time, divides by the 30-second step and runs HMAC over the result with the shared secret. The RFC's test vector uses the secret 12345678901234567890 and the time 59 seconds. 59 divided by 30 gives the counter 1, and the 6-digit code is 287082. A real authenticator does the same with the current time and your own random secret. Pick a strong password for the first factor with the Password Generator.
Common confusion
Two-factor authentication (2FA) is MFA with exactly two factors. A password plus a security question is not MFA: both are things you know. How hard a password is to guess is a matter of Entropy.