Two-factor authentication, usually shortened to 2FA, is a second proof of identity that is independent of your password: something you physically have, such as your phone or a security key, or something you are, such as a fingerprint. Explained simply, an attacker who steals or guesses your password still cannot get in without that second factor. For the accounts that matter, it is the single most effective security setting you can turn on, and it takes a few minutes.
Not all second factors are equal, though. The method a website offers ranges from SMS codes, which stop casual attacks but fall to determined ones, to passkeys, which resist phishing entirely. This guide explains how each one works, what it protects against, and how to set up your accounts so that losing your phone is an inconvenience rather than a disaster.
The three kinds of factor
Security people classify authentication factors as something you know (password, PIN, security question), something you have (phone, hardware key, smart card) and something you are (fingerprint, face). Two-factor authentication means using two different kinds. A password plus a security question is not two-factor; both are things you know, and both can be leaked in the same breach.
Method 1: SMS and email codes
How it works: after you enter your password, the site texts or emails a six-digit code that you type in. The code expires after a few minutes.
What it stops: anyone who has only your password, which covers the bulk of attacks that follow data breaches and credential stuffing.
What it does not stop:
- SIM swapping. An attacker persuades or bribes your mobile carrier to move your number to their SIM, then receives your codes. This is a well-documented attack against people with valuable accounts, particularly cryptocurrency holders.
- Real-time phishing. A fake login page asks for your password, then asks for the code the real site just sent you, and relays both within the code's lifetime. Our guide on how verification codes get stolen walks through the mechanics.
- Email-based codes protect nothing if the attacker already controls your email, which is why your email account itself needs a stronger method.
SMS is still far better than nothing. If it is the only option a site offers, use it. But if you are given a choice, choose one of the methods below, and ask your carrier to add a port-out or account PIN so your number cannot be moved without it.
Method 2: authenticator apps (TOTP)
How it works: when you enable it, the site shows a QR code containing a secret key. An app on your phone such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden stores the secret. Using the current time, it generates a new six-digit code every 30 seconds, following the TOTP algorithm defined in RFC 6238. The site generates the same code from the same secret and checks that they match. Nothing is transmitted to your phone at login time, so there is no SMS to intercept.
What it stops: SIM swapping, interception of codes in transit, and attackers who have your password.
What it does not stop: real-time phishing. A convincing fake page can still ask you for the current code and relay it. The code is only valid for 30 seconds, which narrows the window, but automated phishing kits are built for exactly this.
Practical notes: when you scan the QR code, the site shows backup or recovery codes. Save them in your password manager or print them. They are the only way back in if the phone is lost. Apps that sync encrypted backups across devices, such as Authy or the authenticators built into password managers, make phone loss much less painful; the stock Google Authenticator now offers cloud backup as well.
Method 3: passkeys and hardware security keys
How it works: passkeys are based on public-key cryptography and the FIDO2 / WebAuthn standards. When you register, your device creates a key pair; the site stores the public half, and the private half stays in your phone's secure chip, your computer's secure enclave, or a physical key such as a YubiKey. At login, the site sends a challenge, your device signs it after you unlock with a fingerprint, face or PIN, and the site verifies the signature. Nothing secret ever leaves your device.
What it stops: everything the other methods stop, plus phishing. The signature is bound to the website's real domain, so a lookalike site cannot obtain a valid response even if you try to log in to it. There is no code to type and nothing to relay.
What it does not stop: malware with full control of an unlocked device, or someone who has both your device and your unlock method. Those are much harder attacks than sending a fake email.
Practical notes: passkeys stored in your phone or password manager sync across your devices. Hardware keys do not sync, which is a feature for the highest-security accounts; register at least two and keep one somewhere safe. Support is now broad: Google, Apple, Microsoft, Amazon, PayPal, GitHub and most major services accept passkeys, and many let you use one in place of a password entirely.
Which 2FA method should you use?
Use the strongest method each site offers: a passkey or hardware key first, an authenticator app second, SMS only when nothing else is available. The table below shows why.
| Method | Stops password theft | Stops SIM swap | Stops phishing | Survives phone loss | Effort |
|---|---|---|---|---|---|
| SMS code | Yes | No | No | Yes, with the same number | None |
| Email code | Yes, unless email is compromised | Yes | No | Yes | None |
| Authenticator app | Yes | Yes | No | Only with backups | Low |
| Passkey (phone or manager) | Yes | Yes | Yes | Yes, if synced | Low |
| Hardware key | Yes | Yes | Yes | Only with a spare key | Medium |
What to enable, in order
- Your main email account. It can reset every other password, so it needs the strongest method you can manage: a passkey or hardware key, with an authenticator app as backup. Never rely on SMS alone here.
- Your password manager. It holds everything else.
- Banking, payment and investment accounts, with whatever the strongest offered method is.
- Accounts that hold your identity or your work: cloud storage, social media, developer platforms, your domain registrar.
- Everything else, as the sites offer it. Shopping accounts with a saved card count.
For throwaway accounts there is no need. If you signed up to a one-time site with a disposable address and will never return, there is nothing to protect; the point of 2FA is to guard accounts that would hurt to lose.
What should you do before you lose your phone?
Most 2FA disasters are self-inflicted: a phone is lost, replaced or wiped, and the owner discovers the authenticator app did not back up. Do these now, while everything works:
- Save the recovery codes for every account in your password manager, or print them and store them with your passport.
- Use an authenticator with encrypted backup or a password manager that stores TOTP secrets, so a new phone restores them.
- Register a second method where allowed: a hardware key as well as a phone, or a trusted second device.
- Add a recovery email and phone number, and make sure they are current. Many lockouts happen because the recovery number is a phone you no longer own.
- Write down the account recovery process for your most important accounts before you need it; some take days and require identity documents.
Common questions about prompts and fatigue
Some services use "push" approval: your phone shows "Is this you? Approve or deny". It is convenient and phishing-resistant in the sense that there is no code to relay, but it introduced its own attack: sending dozens of prompts until a tired user taps approve. Services now counter this with number matching, where the login screen shows a number you must enter on the phone.
If you ever receive a prompt you did not trigger, deny it and change your password, because it means someone has your password and is one tap away from your account. The same logic applies to one-time codes that arrive unprompted.
In short
Two-factor authentication is a second, independent proof of identity, and it is the best protection against a stolen password. Passkeys and hardware keys beat phishing; authenticator apps beat SIM swapping; SMS beats nothing but is still worth having. Turn it on for your email first, save the recovery codes, and register a backup method before you need one.
Sources
- RFC 6238: TOTP, the time-based one-time password algorithm used by authenticator apps.
- NIST SP 800-63B, Digital Identity Guidelines: Authentication, including its treatment of phishing-resistant authenticators.
- FIDO Alliance: Passkeys, the standards body behind FIDO2 and WebAuthn.
- CISA: Multifactor Authentication, the US cybersecurity agency's guidance on MFA.
- Google Account Help: Turn on 2-Step Verification.