Two-factor authentication (2FA) adds a second proof of identity beyond your password – usually a one-time code or a tap on your phone or a security key – so a stolen password alone cannot unlock your account. It is one of the most effective, low-effort things you can do to protect your online accounts, which is why security agencies like CISA push it so hard.

Why a password is not enough

Passwords leak all the time – through data breaches, phishing, reuse across sites and simple guessing. Once a password is out, anyone can try it, and because so many people reuse the same password, one leak can open the door to several accounts at once. 2FA breaks that single point of failure: even with your correct password, an attacker is stopped at the second step because they do not have your phone, app or key. That extra layer blocks the large majority of automated account-takeover attempts, which is why security agencies treat it as a baseline rather than an optional extra.

The three types of authentication factors

Security factors fall into three categories, and 2FA combines two of them:

  • Something you know – your password or PIN.
  • Something you have – your phone, an authenticator app, or a hardware security key.
  • Something you are – a fingerprint or face scan.

A code from an app (something you have) added to your password (something you know) is classic 2FA.

SMS vs app vs hardware key

Not all second factors are equally strong. From good to best:

  1. SMS text codes. Convenient and much safer than no 2FA, but the weakest option. Codes can be intercepted, and attackers sometimes hijack your number through SIM-swapping. Use it only if nothing better is offered.
  2. Authenticator apps. Apps like Google Authenticator, Microsoft Authenticator or Authy generate time-based codes on your device. They are not tied to your phone number, so they sidestep SIM-swap attacks. A solid default for most people.
  3. Hardware security keys and passkeys (FIDO). A physical key (such as a YubiKey) or a passkey stored on your device is phishing-resistant: the login is cryptographically bound to the genuine website, so a fake phishing page cannot capture and replay it. CISA and NIST rate these the strongest widely available option.

Why “phishing-resistant” matters. Ordinary codes have a weakness: if a convincing fake site tricks you into typing your password and your one-time code, an attacker can relay both to the real site in seconds. FIDO security keys and passkeys close this gap because they only respond to the legitimate domain. That is the difference CISA highlights when it recommends phishing-resistant MFA for anything important. For most people, this is the reason to move beyond SMS: it is not that text codes are weak in themselves, but that they can be handed to an attacker by a convincing fake page, whereas a security key or passkey simply refuses to work on the wrong site.

How to turn on 2FA

The exact path varies by service, but the pattern is consistent:

  1. Open your account’s Settings, then look for Security or Sign-in.
  2. Find Two-factor authentication or 2-Step Verification and start setup.
  3. Choose your method – an authenticator app or security key is best; SMS if that is all there is.
  4. Complete the prompt (scan a QR code for an app, or register your key).
  5. Save the backup/recovery codes somewhere safe in case you lose your device.

Prioritize your most important accounts first: email (which can reset everything else), banking, and your password manager. Your email is the master key – anyone who controls it can trigger password resets on your other accounts – so it deserves your strongest available method.

Common 2FA mistakes to avoid

Turning on 2FA is a big step up, but a few habits undermine it:

  • Not saving backup codes. Lose your phone with no recovery codes and you can be locked out of your own account. Store them somewhere safe and offline.
  • Relying on a single device. Register a second method or key where you can, so one lost phone is not a disaster.
  • Approving prompts you did not start. If a login approval pops up out of nowhere, deny it – it may mean someone has your password and is trying to get in.
  • Treating SMS as bulletproof. It is fine as a fallback, but move important accounts to an app or key when the option exists.

2FA and the move to passkeys

Passkeys are the next step – they can replace the password entirely while still combining two factors in one phishing-resistant tap. If you want the full picture, read our guide on passkeys and what replaces your password. And since privacy tools are often confused with account security, our explainer on what a VPN is makes clear why 2FA, not a VPN, is what actually guards your logins.