Two-factor authentication means proving who you are with two different things: something you know (a password) plus something you have (a phone, a key) or something you are (a fingerprint).
It exists because passwords leak. Every large breach dumps millions of email-and-password pairs, and attackers try them everywhere. Two-factor means a stolen password on its own isn't enough.
It's the second-highest-return security measure after a password manager, and not all implementations are equal.
The five types, worst to best
5. SMS codes
A code texted to your phone number.
Why it's the weakest: phone numbers can be moved. SIM swapping — where an attacker convinces or bribes a carrier employee to transfer your number to their SIM — is a real, documented technique used against people with valuable accounts. Once they have your number, they receive your codes.
SMS is also vulnerable to interception in various ways, and to simple mistakes: a phone left on a table displays the code on the lock screen.
But use it if it's all that's offered. SMS two-factor is dramatically better than no two-factor. The criticism is relative, not absolute. Most attacks are automated credential stuffing, and SMS defeats those entirely.
If you rely on SMS anywhere, add a PIN or port-freeze to your carrier account. Most carriers offer this and it substantially raises the difficulty of a SIM swap.
4. Email codes
A code sent to your email address.
The problem: if your email is compromised, so is everything using it as a second factor. It's not really a second factor — it's the same factor twice, since your email is also where password resets go.
Acceptable as a fallback. Not a primary method.
3. Authenticator apps
An app on your phone generates a six-digit code that changes every 30 seconds, based on a shared secret and the current time.
Why it's much better: the code is generated on your device with no network involved. Nothing to intercept, no phone number to steal. It works offline.
Remaining weakness: it's phishable. A convincing fake login page can ask for your code and use it within its 30-second window. This is the main attack that still works against authenticator apps, and it's used routinely.
Choose an app that supports encrypted backup or transfer, or you'll lose every code when you lose the phone. This is the most common self-inflicted disaster in this area.
2. Push notifications
The service sends a prompt to an app on your phone; you approve or deny.
Better than codes because there's nothing to type into a fake page, and the prompt usually shows context — location, device, what's being approved.
The weakness is fatigue. Attackers with your password send repeated prompts until you approve one out of irritation or confusion. This works often enough to be a named technique.
The mitigation, used by better implementations, is number matching: the login screen shows a number that you must select in the app. That defeats blind approval.
Rule: never approve a prompt you didn't initiate. If prompts arrive unbidden, your password is compromised — change it immediately.
1. Hardware security keys
A physical device — usually USB or NFC — that you tap or plug in.
Why it's the strongest: the key cryptographically verifies the actual website's identity. A phishing site at a lookalike domain gets nothing, because the key won't respond to the wrong domain. This eliminates phishing as an attack, which no other method does.
There's nothing to type, nothing to intercept, and nothing to fatigue you into approving.
The trade-offs: it costs money, you have to carry it, and you must have a second one. A single key that's lost or broken can lock you out permanently.
Buy two. One on your keyring, one at home as backup. Register both with every account that supports keys.
For anyone with high-value accounts — a business owner, someone with significant crypto holdings, a public figure, anyone who's been targeted before — hardware keys are the right answer and worth the friction.
Also: passkeys
Passkeys are a newer approach that replaces the password entirely with a cryptographic credential stored on your device and unlocked by your fingerprint, face, or device PIN.
They're phishing-resistant like hardware keys, and they sync through your platform or password manager, which removes the lost-device problem. Support is expanding quickly across major services.
Where a service offers passkeys, they're generally the best available option — stronger than password-plus-authenticator and easier to use. Keep a second method registered as a fallback while support is still uneven.
Where to turn it on, in priority order
- Your primary email. Everything resets through it. If you do one thing, do this.
- Your password manager.
- Banking and financial accounts.
- Your phone and computer accounts (Apple, Google, Microsoft) — these control device access and remote wipe.
- Cloud storage.
- Domain registrar and web hosting, if you own a site.
- Social media, particularly anything tied to a business.
- Work accounts.
- Anything with saved payment details.
- Anything holding other people's personal data.
Look for it under Security, Sign-in, or Account settings.
Not locking yourself out
This is the part that goes wrong, and the failure is severe: permanently losing access to your own accounts.
Save the recovery codes. Every service gives you a set when you enable two-factor. They're single-use codes that work when your normal method doesn't. Save them in your password manager, and print a copy for the important ones.
Register two methods wherever the service allows. An authenticator app plus a hardware key, or two hardware keys.
Use an authenticator with backup or transfer. If your app can't move to a new device, replacing your phone means re-enrolling every account manually — assuming you can get in.
Don't store authenticator codes only in the password manager that needs a code to open. Circular lockouts happen.
Keep your recovery email and phone number current. Services check these when you're locked out, and a decade-old number is a dead end.
Write down which accounts have two-factor and which method. During a phone replacement or a lockout, this list is what you work from.
What two-factor doesn't protect against
Session hijacking. If an attacker steals your active session token — through malware or a malicious extension — they're already in and don't need to authenticate. Signing out of all sessions is the fix when you suspect this.
Account recovery abuse. Support processes designed to help locked-out users can sometimes be manipulated. Keeping recovery information accurate and minimal helps.
Someone with physical access to an unlocked device. Two-factor assumes your device is under your control.
Malware on your device, which can read what you type and see what's on screen.
Real-time phishing, against everything except hardware keys and passkeys.
That last point is why hardware keys and passkeys matter for anything genuinely valuable. Everything else can be phished by a sufficiently convincing fake page and a patient attacker.
The practical recommendation
For most people: an authenticator app with encrypted backup, plus recovery codes saved in your password manager and printed for the critical accounts. Turn it on for the top five in the priority list this week.
For anyone with high-value accounts: two hardware keys, registered everywhere they're supported, with an authenticator app as fallback. Passkeys where offered.
Everywhere: never approve a prompt you didn't start, never give a code to someone who contacted you, and treat any unexpected authentication request as evidence your password has leaked.
That last point is worth ending on. An unprompted two-factor request is not an annoyance — it's an alarm. Someone has your password. Change it.
Next in this series: How to Encrypt Sensitive Files on Any Device