Two-Factor Authentication (2FA): A Complete Guide

Why a password alone isn’t enough

Even a strong password can be exposed — through a phishing site, or a breach at some other service entirely. Two-factor authentication (2FA) protects your account by requiring “something in addition to your password,” so a leaked password alone isn’t enough to log in as you.

Types of 2FA

1. SMS verification You receive a text message with a code at login. It’s the most widely supported method, but relatively weak — vulnerable to “SIM swapping,” where an attacker takes over your phone number itself.

2. Authenticator apps (OTP) Apps like Google Authenticator or Authy generate a 6-digit code that changes every 30 seconds. They work without an internet connection and are significantly more secure than SMS — supported by most major services.

3. Hardware security keys A physical device like a YubiKey, connected via USB or NFC, that you tap to confirm login. Currently considered the strongest method — resistant even to phishing. The main downside is the inconvenience of a lost key.

4. Passkeys A rapidly-growing passwordless method that uses your device’s biometrics (fingerprint, face recognition) instead of a password at all. Inherently phishing-resistant and requires no code entry — likely to become the dominant method going forward.

Where to start

Rather than enabling 2FA everywhere at once, prioritize:

1. Your email account — most other services’ password resets flow through email, making it the single most important account to protect.
2. Financial services — banking, brokerage, and payment accounts.
3. Your password manager — since it holds every other password, it’s arguably your single most important security surface.
4. Social media accounts — tied closely to your personal identity and reputation.

Keep your backup codes safe

Enabling 2FA usually generates a set of backup/recovery codes. If you lose your phone or need to reinstall your authenticator app, these codes are what stand between you and being locked out entirely. Print them and store them somewhere safe, rather than relying on a screenshot.

Passwords and 2FA work together

2FA doesn’t replace a strong password — it complements it. Combining a strong, unique password with 2FA is the most reliable way to protect any account.