Two-factor authentication, often shortened to 2FA, means you prove who you are in two different ways when you sign in: something you know, such as a password, plus something you have, such as your phone or a security key. Even if someone steals your password, they still cannot get into your account without the second factor.
It takes a few minutes to set up and blocks many of the most common account takeovers. If you only do one security task this month, turning it on for your email is a very good candidate.
How two-factor authentication works
Security people describe three kinds of proof: something you know (a password or PIN), something you have (a phone or hardware key) and something you are (a fingerprint or face). Two-factor authentication combines two of these categories. Two passwords would not count, because both are the same kind of proof.
The flow looks like this. You enter your password. The site then asks for a second proof, such as a code from an app or a tap on a key. Only when both are right do you get in. An attacker who bought your password from a leaked list gets stopped at step two.
The main types of second factor
Text message codes
The site sends a short code to your phone number. It is easy and works on any phone, which is why it is popular. It is also the weakest common option, because phone numbers can be hijacked through a scam known as SIM swapping, and messages can be intercepted in some situations. It is still far better than no second factor at all.
Authenticator apps
An authenticator app generates a new short code every half minute, without needing a signal. The codes come from a secret shared between the app and the site when you set it up, usually by scanning a QR code. These are a strong choice for most people. Some password managers can store these codes too, which is convenient, though keeping the password and the code in the same place reduces the benefit somewhat.
Push approvals
Some services send a prompt to your phone asking you to approve or deny a login. They are quick, but beware of approving a request you did not start. If a prompt appears out of the blue, deny it and change your password.
Security keys
A physical key that you plug in or tap against your phone. It offers the strongest protection against fake login pages, because the key checks the real website address before it responds. Buy two, so you have a spare.
Passkeys
Passkeys replace the password with a cryptographic key stored on your device and unlocked by your fingerprint, face or screen PIN. Support is growing. Where a site offers passkeys, they are often both easier and safer than a password.
| Method | Ease | Protection |
|---|---|---|
| Text message | Very easy | Basic |
| Authenticator app | Easy | Strong |
| Push approval | Very easy | Good, if you stay alert |
| Security key | Moderate | Very strong |
| Passkey | Easy | Very strong |
Where to turn on two-factor authentication first
Prioritize accounts that can unlock others or cost you money.
- Your main email. It resets passwords for almost everything else.
- Your password manager. It holds your other logins, as covered in our password manager guide.
- Banking, payments and tax accounts.
- Cloud storage and work tools, where files and client data live.
- Social media and online stores.
Setting it up step by step
- Open the account’s security or sign-in settings and look for two-step verification or 2FA.
- Choose your method. If an authenticator app or security key is available, prefer it over text messages.
- Follow the prompts, such as scanning a QR code with your app.
- Enter a test code to confirm that it works.
- Save the backup codes the site gives you, and store them somewhere safe, not just on the phone that holds your app.
Plan for losing your phone
The most common reason people dislike 2FA is the fear of being locked out. A little planning removes the risk.
- Keep printed or securely stored backup codes for important accounts.
- Add a second method where allowed, such as a spare security key.
- Check whether your authenticator app can back up or transfer codes to a new phone before you need to.
- Keep your recovery email and phone number up to date.
Store those backup files in a place that is itself protected and copied elsewhere, in line with the 3-2-1 backup rule.
Common mistakes and scams
Never share a verification code with anyone, even if they claim to be from the company. Legitimate staff will not ask for it. Be careful with login pages reached through links in messages, because a fake page can ask for your code and pass it on instantly. Open the site yourself or use your password manager, which only fills in on the true address.
Also avoid using a number you might lose, such as an old work phone, as your only recovery route. For more articles like this one, see our technology section.
Where to start
Open your email account’s security settings today and turn on two-step verification with an authenticator app. Save the backup codes in a safe place, then repeat for your password manager and your bank. Three accounts protected in half an hour is a solid start, and you can do the rest over the coming weeks.
Frequently asked questions
Is two-factor authentication really necessary?
It is strongly recommended. It stops most attacks that rely on a stolen or guessed password, especially for email and financial accounts.
Is SMS or an authenticator app better?
An authenticator app is generally stronger, because text messages can be intercepted or redirected. SMS is still better than having no second factor.
What if I lose my phone?
Use the backup codes you saved when setting it up, or a second method such as a spare security key. Keep those codes stored somewhere safe and separate.
Should I share a verification code if someone asks?
Never. Genuine companies do not ask for codes, and anyone who does is likely trying to access your account.
