A 2-factor authentication code is generated using a combination of two different components: something the user knows (like a password) and something the user has (like a physical token or a mobile device). The code is usually generated using an algorithm that combines these two components.