You keep half of the encrypted code, typically stored either in the cloud with a compatible verification app – including Authenticator – or on a physical security dongle.