Two factors of 2FA means any two of what you know, what you have, or what you are. The idea is that one factor is not enough, because a password can be compromised and then you are fucked. Somebody has successfully compromised my GitHub password in the past 2FA prevented them from gaining access even with my password.