Two-factor authentication explained: what it is, why you need it, and how to turn it on

Two-factor authentication, commonly shortened to 2FA, is a login method that requires two separate pieces of evidence before it grants access to your account. The idea is that even if someone steals your password, they still cannot log in without the second factor — something only you physically have.

The name comes from the three classic categories of authentication: something you know (a password), something you have (a physical device or code), and something you are (a fingerprint or face scan). Two-factor authentication combines any two of these, though in practice it almost always means your password plus a one-time code.

Why 2FA matters

Data breaches happen constantly, and stolen password lists are sold and traded online. If you reuse a password — or if a service you use has poor internal security — your credentials can end up in the hands of someone trying to break into accounts automatically. 2FA breaks this attack: even with a correct password, they cannot get past the second step without access to your device.

The three main types of 2FA, ranked

1. Hardware security keys (strongest)

A physical USB or NFC key (brands include YubiKey and Google Titan) that you plug in or tap to your phone. It is resistant to phishing because it checks the site's real domain before responding — a fake login page gets nothing. Best for: journalists, activists, executives, anyone with a serious threat model.

2. Authenticator apps (recommended for most people)

Apps like Google Authenticator, Authy, or Apple's built-in password manager generate a new six-digit code every 30 seconds. You enter it after your password. These codes work offline, are not interceptable by your phone carrier, and are not exposed in SIM-swap attacks. This is the tier most security professionals recommend for everyday accounts.

3. SMS text message codes (weakest — but still much better than nothing)

A one-time code is sent to your phone by text. This is the most common form of 2FA and is far better than no 2FA at all. However, it has a known weakness: SIM-swap attacks, where a criminal convinces your carrier to transfer your number to their device. For high-value accounts (email, banking, crypto), upgrade to an authenticator app if available.

Which accounts to enable it on first

1. Email — your email resets all your other passwords, making it the highest-value target.
2. Banking and financial services — obvious high-value target; most now mandate 2FA anyway.
3. Social media — account takeovers are common and can be used for scams or reputational harm.
4. Password manager — protects every other password in one place.
5. Work accounts and cloud storage — contain sensitive personal or business data.

How to turn it on (general steps)

1. Go to the account's security or privacy settings.
2. Look for "Two-factor authentication," "Two-step verification," or "Login verification."
3. Choose your preferred method: authenticator app is recommended.
4. Scan the QR code with your authenticator app, or enter the setup key manually.
5. Enter the first code the app generates to confirm setup.
6. Save your backup/recovery codes somewhere secure — printed and physically stored is safest.

The backup codes step is important. If you lose your phone or uninstall the app, backup codes are your only way back into the account without going through a lengthy recovery process.

General information, not security advice for specific threat models. If you manage sensitive personal, medical or financial information, consider consulting a cybersecurity professional.