Two-factor authentication (2FA) is a security method that requires you to verify your identity in two separate ways before accessing an account. A password is the first factor. The second is usually a code sent to your phone, a code generated by an app, or a physical key. Even if someone steals your password, they can't get in without that second factor. That's the entire point.
Passwords fail constantly. People reuse them across sites, attackers buy leaked credential lists for a few dollars, and phishing campaigns harvest login details at scale. 2FA doesn't fix the password problem, but it makes a stolen password far less useful.
How two-factor authentication actually works
When you log in to an account with 2FA enabled, the site or app accepts your password and then asks for a second proof of identity. The three most common second factors are:
- SMS codes: a one-time code texted to your mobile number.
- Authenticator apps: a six-digit code generated on your phone by an app like Google Authenticator or Authy. The code refreshes every 30 seconds.
- Hardware security keys: a physical USB or NFC device like a YubiKey that you tap or plug in to confirm the login.
Each option sits on a spectrum from convenient to highly secure. SMS codes are the most common and the weakest. Hardware keys are the most secure and the least common for everyday use.
Why SMS codes are the weakest option
SMS-based 2FA is better than nothing. It stops the casual attacker who bought your password from a data breach and tries to log in from across the world. But SIM-swapping attacks undermine it badly. In a SIM swap, a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. From that point, every SMS code you should receive goes to them instead.
SIM swaps have been used to drain cryptocurrency wallets, hijack social media accounts, and compromise email. The attack doesn't require any malware on your device. It requires only a social engineering call to your carrier. Carriers vary in how well they protect against this, and not all do it well.
If SMS is your only option for a given account, enable it. It still raises the bar significantly. But move to an authenticator app wherever a site allows it.
Authenticator apps: the practical sweet spot
Authenticator apps generate codes locally on your device using a shared secret established when you first scan the QR code during setup. No SMS network is involved. The codes work offline. Because the secret never leaves your device during normal use, there's nothing for a carrier to hand over.
Google Authenticator, Microsoft Authenticator, and Authy all do the core job. Authy adds encrypted cloud backup of your codes, which helps if you lose your phone. Microsoft Authenticator supports push notifications for Microsoft accounts, letting you approve a login with a tap rather than typing a code. The right choice depends on which accounts you're protecting most.
Setup takes about 60 seconds per account. You open the security settings for the account, select "authenticator app" as your 2FA method, scan the QR code with the app, and confirm with one generated code. Done. From that point, every login asks for a fresh 6-digit code after your password.
Hardware keys: the strongest protection available
A hardware security key like a YubiKey plugs into a USB port or taps against an NFC reader on your phone. It uses a cryptographic protocol called FIDO2 (or its predecessor U2F) to verify the login. The key proves to the site that you're physically present, and the protocol is built so that the verification only works for the actual site you're on, not a lookalike phishing site.
That anti-phishing property is the hardware key's main advantage over authenticator apps. If you're tricked into entering your password on a fake login page, an authenticator code can still be captured and replayed in real time by the attacker. A hardware key won't authenticate to a fake domain. The cryptographic handshake fails because the domain doesn't match.
Hardware keys suit high-value accounts: business email, banking, password managers, and any service holding sensitive data. A key costs between $30 and $70 and lasts years. For the accounts where a breach would cause serious harm, that cost is trivial.
Which accounts should you protect first?
Start with email. Your email account is the recovery mechanism for almost every other account you own. Control of your inbox lets an attacker reset passwords across dozens of sites. Lock that down first with an authenticator app or hardware key.
Next: your password manager, banking, and any cloud storage holding important files. Then social media, work accounts, and any service you've linked to your payment details. If a site offers 2FA and stores anything you'd be uncomfortable losing or exposing, enable it.
The small business cybersecurity checklist on this site lists 2FA as one of 10 essential measures, and that ranking is correct. For businesses, the stakes are higher because compromised accounts often carry access to shared systems, client data, and financial accounts. Enabling 2FA across staff accounts takes an afternoon and prevents a category of attack that bypasses every other control you've put in place.
Common reasons people skip 2FA (and why they don't hold up)
"It's too inconvenient." Typing a 6-digit code takes about 5 seconds. That's roughly the time it takes to type a password. The friction is real but small.
"I'll lose access if I lose my phone." Most services provide backup codes when you set up 2FA. Store them somewhere safe, like a printed copy in a locked drawer or inside your password manager. Some authenticator apps like Authy back up your codes to the cloud. This is a solvable problem, not a reason to leave accounts exposed.
"My password is strong enough." Password strength doesn't protect against phishing, credential stuffing from breached databases, or malware that logs keystrokes. A strong password is a good habit. It isn't a substitute for 2FA.
Passkeys and where they fit
Passkeys are a newer approach that collapses the two-factor step into a single authentication method. Rather than a password plus a code, a passkey uses a cryptographic key pair tied to your device, verified with your fingerprint or face. Sites like Apple, Google, and GitHub already support passkeys as a login option.
They're not 2FA in the traditional sense, but they're at least as secure as a hardware key plus a strong password combined. The site's article on password managers vs passkeys covers this comparison in detail. For now, passkeys aren't universally available, so enabling 2FA on every account that supports it remains the practical action most people should take today.
Two-factor authentication isn't a perfect defence. Nothing is. But it closes the most common attack path, the one that starts with a stolen or guessed password, and it does so with very little effort on your part. Enable it on your email account this week. The rest can follow.