Two-factor authentication adds a second step to login: something you know (your password) plus something you have (a code or a key). Even if a keylogger or breach exposes your password, the attacker is still missing the second factor.
The main methods, weakest to strongest
- SMS codes — better than nothing, but vulnerable to SIM-swapping and interception.
- Authenticator apps — generate time-based codes on your phone, offline. A solid default for most people.
- Push approvals — tap “approve” on your phone; convenient, but beware approving prompts you did not start.
- Hardware security keys — physical keys (FIDO2/passkeys) that resist phishing. The strongest option.
⚠
Save your backup codesWhen you enable 2FA, store the one-time recovery codes somewhere safe and offline. They get you back in if you lose your phone or key.
Where to turn it on first
Start with the accounts that unlock everything else: your email, your password manager, and your banking and cloud accounts. Then work outward to social media and shopping. It takes minutes per account and dramatically raises the bar for attackers.