What Is Two-Factor Authentication and Should I Use It?
Two-factor authentication adds a second check, usually a code from your phone, so a stolen password alone is not enough. It blocks most account takeovers.
In short
Two-factor authentication, or 2FA, requires something you have, such as a code from an app or a physical key, alongside something you know, your password. Even if your password is stolen or leaked, an attacker cannot log in without the second factor. Turn it on for your email first, then banking, then everything else, using an authenticator app rather than SMS where possible.
Most account takeovers do not involve anyone breaking into anything. They involve a password that was leaked from one site being tried on another, and working. Two-factor authentication makes that attack fail even when the password is correct.
The idea
A factor is a category of proof: something you know, such as a password; something you have, such as your phone; or something you are, such as a fingerprint. Two-factor means two different categories.
A password and a security question are one factor twice, both things you know. A password plus a code from your phone is two factors, because an attacker who has your password does not have your phone.
The methods, weakest to strongest
SMS codes. A text with a six-digit number. Widely supported and better than nothing, but vulnerable to SIM-swapping, where a criminal convinces your mobile network to move your number. Also unreliable abroad or without signal.
Email codes. Only as strong as the email account, which should itself be protected by something stronger.
Authenticator apps. Google Authenticator, Microsoft Authenticator, Authy and others generate a code that changes every 30 seconds, from a secret shared once at setup. No network needed, no SIM to hijack. This is the sensible default.
Push notifications. The service sends a prompt to your phone and you tap approve. Convenient, and vulnerable to “prompt fatigue” attacks where an attacker triggers prompts until you approve one by mistake. Approve only prompts you initiated.
Hardware security keys. A small USB or NFC device such as a YubiKey. Immune to phishing, because the key checks the site’s domain. The strongest option for accounts that matter.
Passkeys. The newest approach, built into phones and browsers, with the same phishing resistance as hardware keys and no extra device. Where available, these replace both the password and the second factor.
Where to turn it on first
In this order:
- Email. It is the recovery route for every other account. Whoever controls your email can reset everything else.
- Banking and payment services. Most already require it.
- Password manager, if you use one.
- Social media and anything with your card details stored.
- Everything else that offers it.
Backup codes
Every service that offers 2FA gives you a set of one-time backup codes at setup. These are what you use when your phone is lost, broken or replaced. Store them in a password manager or print them and keep them somewhere physically safe. Losing your phone without backup codes is the most common way people lock themselves out permanently.
What it does not do
It does not protect against a phishing page that collects your password and your code together and uses them immediately. That attack is real and increasingly common. Authenticator codes are still far better than a password alone, but for the accounts you most care about, a hardware key or a passkey is the version that closes the gap.
Common questions
Is SMS two-factor safe?
Better than nothing, and the weakest option. Text codes can be intercepted by SIM-swap fraud, where an attacker persuades your mobile provider to move your number to their SIM. An authenticator app or a passkey avoids that entirely.
What if I lose my phone?
When you set up 2FA, the service gives you backup codes. Save them somewhere secure, such as a password manager or printed in a safe place. With them you can sign in and register a new device. Without them, recovery can take days or fail.
Does 2FA stop phishing?
It stops the common case where a leaked password is tried against your accounts. It does not fully stop a real-time phishing site that asks for your code as well. Passkeys and hardware keys close that gap.
Sources
Every factual claim above traces to one of these. Follow them rather than taking this article's word for it.
- Setting up 2-step verification National Cyber Security Centre
- Use a strong and separate password for your email National Cyber Security Centre
- Phishing scams National Cyber Security Centre
Try it yourself
Free, instant, and nothing you enter leaves your browser.