The idea in one paragraph
Normally you prove who you are to an account with a password. Two-factor authentication, often shortened to 2FA, asks for a second, different kind of proof as well. If someone learns your password, perhaps from a fake email or a data breach, they still cannot sign in without the second piece. It does not make an account unbreakable, but it blocks many of the most common takeover attempts.
The three kinds of “factor”
Security professionals group proofs of identity into three categories.
- Something you know: a password, PIN or answer to a question.
- Something you have: a phone, a hardware key or a card.
- Something you are: a fingerprint, face or similar feature.
Two-factor authentication combines two different categories. Entering two passwords is not two-factor, because both are things you know. Many services use the word multi-factor to cover systems with two or more.
The common second steps
Codes sent by text message
The service sends a short numeric code to your phone number, and you type it in. This is easy to understand and needs no extra app. Its weaknesses are that text messages can be intercepted or redirected in certain attacks, such as someone persuading a mobile provider to move your number to another SIM card, and that you need mobile signal. It is still much better than no second step at all, and for many people it is a sensible starting point.
Authenticator apps
An app on your phone generates a code that changes every thirty seconds or so. When you set the account up, you scan a QR code or enter a key, so the app and the service share a secret. Afterwards the codes are calculated on your phone without needing a signal, and nothing travels by text message. This is generally considered stronger than text-message codes. The things to watch are what happens if you lose or replace the phone, and the fact that a fake website can still trick you into typing a valid code, because the code is not tied to the site you are on.
Approval prompts
Some services send a notification to a trusted device asking you to approve or deny a sign-in. They are convenient but can be abused: attackers sometimes trigger repeated requests hoping you will tap “approve” out of annoyance. Only approve a request that you started yourself, and report unexpected ones.
Security keys and passkeys
A hardware security key is a small device, which you plug in or tap to your phone, that proves your identity using cryptography. Passkeys are a related, newer approach that stores a credential on your device, unlocked by your fingerprint, face or PIN, and which replaces the password altogether on supporting services. Both are designed so that they work only on the genuine website, which makes them far more resistant to phishing emails than typed codes. The drawbacks are cost for hardware keys, uneven support across websites, and the need to plan for a lost device. Which method suits you depends on the sensitivity of the account and what the service supports.
Biometric checks
Fingerprint or face unlocking is often used to unlock a phone or an authenticator rather than to sign in directly. The biometric check typically happens on your device, not on a distant server.
A quick comparison
| Method | Ease | Resistance to fake sites | Main caution |
|---|---|---|---|
| Text message code | Very easy | Limited | Number takeover, signal needed |
| Authenticator app | Easy | Limited | Lost phone, set-up transfer |
| Approval prompt | Very easy | Limited | Accidental approvals |
| Security key or passkey | Moderate | Strong | Cost, support, lost device |
The ratings are general. Particular products and settings differ.
Setting it up sensibly
Start with the accounts that cause the most harm if lost. Your email comes first, because it can reset many other passwords. Next come banking, cloud storage, social media and any learning accounts that hold personal or payment information. Look in the account’s security settings for “two-step verification”, “two-factor authentication” or “multi-factor authentication”.
When you enable it, you will usually be given backup or recovery codes. Store these somewhere safe and separate from your phone, such as in a password manager entry or printed and kept at home. They are your way back in if the phone is lost.
Avoiding lock-outs
- Add more than one method if the service allows, such as an app and a backup key.
- Keep your phone number and recovery email up to date.
- Before replacing or resetting a phone, check how to move your authenticator accounts across.
- Do not share codes with anyone. Genuine staff of a service will not ask for a one-time code. A caller or message that does is likely to be a scam.
- If you have a device-bound passkey, find out how it is backed up before you need it.
Limits worth knowing
Two-factor authentication helps against stolen passwords but not against everything. If malware is running on your device, or you approve a request for an attacker, the second step may not help. Real-time fake sites can pass on a typed code as you enter it. That is why it works best alongside long unique passwords, careful reading of messages and regularly applied software updates.
If a service offers a second step and you are unsure which to pick, an authenticator app is a widely suggested balance of security and convenience, and a security key or passkey is better still for important accounts. Your institution’s IT help pages or your national cyber security agency can advise on the options that apply to your accounts.