What Is Two-Factor Authentication and Why You Should Turn It On Today
A password alone isn't enough any more. Here's how 2FA works, which type to pick, and the five accounts to protect first.
Two-factor authentication (2FA) is a login step that asks for a second proof of identity after your password — usually a code from your phone, a tap on a prompt, or a physical security key. Even if someone steals your password, they can’t get in without that second factor. It takes about two minutes per account to set up, and it blocks the vast majority of automated account takeovers.
How two-factor authentication works
Security people talk about three kinds of proof: something you know (a password or PIN), something you have (a phone or key) and something you are (a fingerprint or face). Two-factor authentication simply combines two of them. You’ll also see it called multi-factor authentication, or MFA — the idea is the same.
Here’s what a typical login looks like with 2FA switched on:
- You enter your email and password as usual.
- The site asks for a second factor.
- You type a six-digit code from an app, approve a prompt, or tap your security key.
- You’re in — and the site can remember that device so you’re not asked every time.
Types of 2FA, from weakest to strongest
| Method | How it works | Security |
|---|---|---|
| SMS text code | A code is texted to your phone | Better than nothing; vulnerable to SIM-swap scams |
| Email code | A code arrives by email | Only as safe as your email account |
| Authenticator app | An app generates a new code every 30 seconds | Strong and free |
| Push prompt | You approve a login on your phone | Strong, if you never approve prompts you didn’t trigger |
| Passkey or security key | A cryptographic key on your device or a USB/NFC key | Strongest; resists phishing |
If you’re choosing today, an authenticator app is the sweet spot for most people. Passkeys are even better where they’re offered, because there’s no code for a scammer to trick you into typing.
Why two-factor authentication matters
Passwords leak all the time — through data breaches at companies you’ve never thought about, phishing emails, or simply reusing the same password everywhere. Attackers buy those lists and try them automatically. With 2FA turned on, a leaked password is suddenly worth very little. The US Cybersecurity and Infrastructure Security Agency calls it one of the simplest steps you can take; its MFA guidance is worth a skim.
Which accounts to protect first
- Your main email — it’s the key to resetting every other password.
- Banking and payment apps, including PayPal and card accounts.
- Your Apple, Google or Microsoft account — these hold your backups, photos and device access.
- Social media, which scammers hijack to target your friends.
- Work accounts and password managers.
How to set up 2FA in five minutes
- Install an authenticator app on your phone.
- Open the security settings of the account you want to protect and look for “Two-step verification” or “2FA”.
- Choose the authenticator app option and scan the QR code shown.
- Type the code the app displays to confirm it works.
- Save the backup codes somewhere safe — a password manager or a printed sheet at home.
Don’t skip the backup codes. If you lose your phone, they’re how you get back into your account. Losing both is the most common way people lock themselves out.
Passkeys: the next step after 2FA
You’ll increasingly see sites offer to “create a passkey”. A passkey replaces your password with a cryptographic key stored on your phone or computer, unlocked with your face, fingerprint or device PIN. Because there’s no password to type and nothing to copy, phishing sites can’t steal it. Apple, Google and Microsoft all support passkeys and sync them across your devices.
If a service offers passkeys, it’s worth switching. You can usually keep your authenticator app as a backup method while you get used to it.
How to choose an authenticator app
Most free authenticator apps do the same job, so focus on two things: backup and trust. Choose an app from a well-known company, and check whether it can back up your accounts securely so a lost phone doesn’t mean starting over. Many password managers now include a built-in authenticator, which keeps everything in one place.
| What to check | Why it matters |
|---|---|
| Encrypted backup | Restores your codes on a new phone |
| Reputable developer | You’re trusting it with account access |
| Works offline | Codes still generate without signal |
| App lock | Stops someone with your unlocked phone seeing codes |
Setting up 2FA for your family
Parents and older relatives are often targeted by scammers, and they’re also the people most likely to be locked out if 2FA isn’t set up carefully. Sit down together, protect their email and banking first, print the backup codes and keep them somewhere safe at home. Five minutes of help can save weeks of account recovery later.
Common 2FA mistakes to avoid
Never read a 2FA code to anyone who calls or texts you, even if they claim to be your bank. Never approve a login prompt you didn’t start. And if you’re buying a second-hand phone, make sure it’s been wiped — our guide on checking an iPhone IMEI covers what else to verify before you pay.
Frequently asked questions
Is two-factor authentication really necessary?
Yes. It’s one of the most effective ways to stop account takeovers because a stolen password alone is no longer enough to log in.
What happens if I lose my phone with 2FA on?
Use the backup codes you saved during setup, or a second registered device or key. Without them you’ll need to go through the service’s account recovery process.
Is SMS 2FA safe?
It’s much better than a password alone, but it can be intercepted through SIM-swap fraud. Use an authenticator app or passkey where possible.
What’s the difference between 2FA and MFA?
2FA uses exactly two factors. MFA means two or more. In everyday use the terms are interchangeable.
Is a passkey better than two-factor authentication?
A passkey is designed to be phishing-resistant and often replaces both the password and the second factor. Where it’s offered, it’s generally the more secure option.
