A password proves you know a secret. Two-factor authentication, usually shortened to 2FA, adds a second proof that is independent of the first: something you physically have, such as your phone or a security key, or something you are, such as a fingerprint. An attacker who steals or guesses your password still cannot get in without the second factor. For the accounts that matter, it is the single most effective security setting you can turn on, and it takes a few minutes.
Not all second factors are equal, though. The method a website offers ranges from SMS codes, which stop casual attacks but fall to determined ones, to passkeys, which resist phishing entirely. This guide explains how each one works, what it protects against, and how to set up your accounts so that losing your phone is an inconvenience rather than a disaster.
The three kinds of factor
Security people classify authentication factors as something you know (password, PIN, security question), something you have (phone, hardware key, smart card) and something you are (fingerprint, face). Two-factor authentication means using two different kinds. A password plus a security question is not two-factor; both are things you know, and both can be leaked in the same breach.
Method 1: SMS and email codes
How it works: after you enter your password, the site texts or emails a six-digit code that you type in. The code expires after a few minutes.
What it stops: anyone who has only your password, which covers the bulk of attacks that follow data breaches and credential stuffing.
What it does not stop:
- SIM swapping. An attacker persuades or bribes your mobile carrier to move your number to their SIM, then receives your codes. This is a well-documented attack against people with valuable accounts, particularly cryptocurrency holders.
- Real-time phishing. A fake login page asks for your password, then asks for the code the real site just sent you, and relays both within the code's lifetime.
- Email-based codes protect nothing if the attacker already controls your email, which is why your email account itself needs a stronger method.
SMS is still far better than nothing. If it is the only option a site offers, use it. But if you are given a choice, choose one of the methods below, and ask your carrier to add a port-out or account PIN so your number cannot be moved without it.
Method 2: authenticator apps (TOTP)
How it works: when you enable it, the site shows a QR code containing a secret key. An app on your phone such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden stores the secret and, using the current time, generates a new six-digit code every 30 seconds. The site generates the same code from the same secret and checks that they match. Nothing is transmitted to your phone at login time, so there is no SMS to intercept.
What it stops: SIM swapping, interception of codes in transit, and attackers who have your password.
What it does not stop: real-time phishing. A convincing fake page can still ask you for the current code and relay it. The code is only valid for 30 seconds, which narrows the window, but automated phishing kits are built for exactly this.
Practical notes: when you scan the QR code, the site shows backup or recovery codes. Save them in your password manager or print them. They are the only way back in if the phone is lost. Apps that sync encrypted backups across devices, such as Authy or the authenticators built into password managers, make phone loss much less painful; the stock Google Authenticator now offers cloud backup as well.
Method 3: passkeys and hardware security keys
How it works: passkeys are based on public-key cryptography and the FIDO2 / WebAuthn standards. When you register, your device creates a key pair; the site stores the public half, and the private half stays in your phone's secure chip, your computer's secure enclave, or a physical key such as a YubiKey. At login, the site sends a challenge, your device signs it after you unlock with a fingerprint, face or PIN, and the site verifies the signature. Nothing secret ever leaves your device.
What it stops: everything the other methods stop, plus phishing. The signature is bound to the website's real domain, so a lookalike site cannot obtain a valid response even if you try to log in to it. There is no code to type and nothing to relay.
What it does not stop: malware with full control of an unlocked device, or someone who has both your device and your unlock method. Those are much harder attacks than sending a fake email.
Practical notes: passkeys stored in your phone or password manager sync across your devices. Hardware keys do not sync, which is a feature for the highest-security accounts; register at least two and keep one somewhere safe. Support is now broad: Google, Apple, Microsoft, Amazon, PayPal, GitHub and most major services accept passkeys, and many let you use one in place of a password entirely.
A comparison at a glance
| Method | Stops password theft | Stops SIM swap | Stops phishing | Survives phone loss | Effort |
|---|---|---|---|---|---|
| SMS code | Yes | No | No | Yes, with the same number | None |
| Email code | Yes, unless email is compromised | Yes | No | Yes | None |
| Authenticator app | Yes | Yes | No | Only with backups | Low |
| Passkey (phone or manager) | Yes | Yes | Yes | Yes, if synced | Low |
| Hardware key | Yes | Yes | Yes | Only with a spare key | Medium |
What to enable, in order
- Your main email account. It can reset every other password, so it needs the strongest method you can manage: a passkey or hardware key, with an authenticator app as backup. Never rely on SMS alone here.
- Your password manager. It holds everything else.
- Banking, payment and investment accounts, with whatever the strongest offered method is.
- Accounts that hold your identity or your work: cloud storage, social media, developer platforms, your domain registrar.
- Everything else, as the sites offer it. Shopping accounts with a saved card count.
For throwaway accounts there is no need. If you signed up to a one-time site with a disposable address and will never return, there is nothing to protect; the point of 2FA is to guard accounts that would hurt to lose.
Before you lose your phone
Most 2FA disasters are self-inflicted: a phone is lost, replaced or wiped, and the owner discovers the authenticator app did not back up. Do these now, while everything works:
- Save the recovery codes for every account in your password manager, or print them and store them with your passport.
- Use an authenticator with encrypted backup or a password manager that stores TOTP secrets, so a new phone restores them.
- Register a second method where allowed: a hardware key as well as a phone, or a trusted second device.
- Add a recovery email and phone number, and make sure they are current. Many lockouts happen because the recovery number is a phone you no longer own.
- Write down the account recovery process for your most important accounts before you need it; some take days and require identity documents.
Common questions about prompts and fatigue
Some services use "push" approval: your phone shows "Is this you? Approve or deny". It is convenient and phishing-resistant in the sense that there is no code to relay, but it introduced its own attack: sending dozens of prompts until a tired user taps approve. Services now counter this with number matching, where the login screen shows a number you must enter on the phone. If you ever receive a prompt you did not trigger, deny it and change your password, because it means someone has your password and is one tap away from your account.