A password on its own is a single lock, and there are a few well-worn ways past it. Knowing how they work makes it clear why a second factor helps so much.
Passwords leak, then get reused
Companies get breached, and when they do, lists of email addresses and passwords end up circulating. If you used the same password in more than one place, one leak now affects several of your accounts. Attackers count on this. They take a leaked email-and-password pair and try it automatically across many popular sites to see where else it works. This is called credential stuffing. It is not clever guessing, it is reuse being punished at scale.
You get tricked into typing it
The other common route is phishing: a message or page designed to look like a real service, built to make you type your password on a fake site. The page looks right, the logo is there, and in a hurried moment it is easy to hand over your details without noticing the address is wrong.
Why a second factor blocks most of this
With 2FA on, your password alone is no longer enough. An attacker who buys your leaked password still cannot log in, because they do not have the code from your app or the passkey on your device. That single change defeats most credential-stuffing attempts outright, because those rely on password-only logins.
What 2FA does not stop
2FA is strong, not magic. Some phishing pages now ask for your code too, and pass it on in real time. So keep two habits alongside it: never type your password or code on a page you reached by tapping a link, and prefer a passkey or an authenticator app over text-message codes, which are easier to intercept.
Put simply: a unique password stops reuse, and a second factor stops most of the rest. Together they close the doors attackers use most.