The basic idea
Signing in with only a password means that anyone who learns the password can be you. Two-factor authentication, often shortened to 2FA, adds a second check from a different category. Security people describe three categories: something you know (a password or PIN), something you have (a phone or a small physical key) and something you are (a fingerprint or face). Using two different categories means that stealing one is not enough.
In practice: you enter your password, then the site asks for a second proof, such as a code from an app. A criminal with only your leaked password gets stopped at the second step.
You may also hear “two-step verification” and “multi-factor authentication”. The names are used loosely and differ slightly in meaning, but for everyday purposes they describe the same idea.
Why it matters
Passwords leak, get guessed, are reused and are handed to fake websites. A second factor limits the harm from all of those. It is especially valuable because a lot of attacks are automated: criminals try leaked passwords from past data breaches across many sites. Where two-factor sign-in is on, those attempts mostly fail.
It is not a complete shield. A convincing fake login page can sometimes trick you into typing the second code as well, and a determined attacker may be able to take over a phone number. But it raises the effort required considerably, and security guidance commonly recommends it for important accounts.
The main types of second factor
Text message codes. A short code is sent to your phone number. It is easy to use and works on basic phones, but it is the weakest common option, because text messages can be intercepted in some circumstances, and criminals sometimes convince a phone company to move a number to a new SIM card. It is still much better than nothing.
Authenticator apps. An app on your phone generates a code that changes every thirty seconds or so. It works without a phone signal and avoids the phone-number problem. You set it up once by scanning a code that the site shows. If you lose or replace the phone, you need to recover the setup, so the app’s backup options matter.
Push approvals. A prompt appears on your phone asking you to approve or deny a sign-in. They are convenient, but a bad habit is approving a prompt you did not trigger. If a prompt appears when you are not signing in, deny it and change your password.
Security keys. A small physical device you plug in or tap to your phone. These are generally considered the strongest everyday option, since they check that you are on the real website and cannot be tricked by a fake page. They cost money, and you should have a spare in case one is lost.
Passkeys. A newer approach in which your device uses a stored cryptographic credential, unlocked by your fingerprint, face or screen PIN, in place of a password. The details differ between services and systems, and it is worth reading how each one works before relying on it.
Biometrics. Fingerprint and face unlock are frequently the way you unlock the device that holds the second factor. The strengths and limits of this approach are discussed in biometric authentication.
Email codes. Some sites send a code to your email address. This is only as secure as the email account itself, which is another reason to protect that account first.
Where to start
You do not need to switch it on everywhere at once. A sensible order:
- Your main email account. It can usually reset the passwords of everything else.
- Banking and financial accounts.
- Your password manager, if you use one. The explanation of password managers covers why.
- Phone account and app store or cloud accounts, which hold backups and purchases.
- Social media and shopping accounts.
- Work accounts, following your employer’s rules.
Look in each account’s security or privacy settings for options labeled two-step verification, multi-factor authentication or login verification.
Avoiding lockouts
The most common problem with 2FA is losing access, so prepare:
- Save the backup codes. Many services offer a list of one-time codes when you set up 2FA. Store them somewhere safe and separate from your phone, such as a printed copy in a secure place or in a password manager.
- Add more than one method if allowed, for example an authenticator app plus a security key.
- Keep your phone number and recovery email current.
- Plan for a new phone. Many authenticator apps need you to transfer your accounts before you wipe or replace the old device. See the guidance on wiping old devices, which also applies before you sell or hand one on.
- Think about family. If something happens to you, how would a trusted person access important accounts? This links to digital legacy.
Protecting yourself while using it
- Never share a code with anyone who contacts you, including someone claiming to be from a bank or the service itself. A code requested over the phone is a standard scam move.
- Be cautious of unexpected approval prompts and of codes you did not request, which can mean someone has your password.
- Keep the apps and phone up to date, since software updates fix security flaws.
- Sign in only on addresses you know, ideally by using a saved bookmark or an app.
Is it worth the bother?
Most people find the extra few seconds a small price. For accounts holding money, identity or personal messages, the added protection is substantial, though not total. If a service offers a choice, an authenticator app or a security key is generally preferable to text messages, but any second factor beats none. For the other habits that fit alongside it, see the family guide to online safety. This is general information and cannot guarantee that an account will never be compromised.