Passwords alone are not enough. Even a strong password can be stolen in a breach or typed into a phishing site. Two-factor authentication, often called 2FA or multi-factor authentication, adds a second check, such as a code from your phone or a hardware key, so a stolen password by itself is not enough to get into your account.
This guide explains the main 2FA methods, how to set them up and how to avoid locking yourself out.
How Two-Factor Authentication Works
Authentication factors typically fall into three types:
- Something you know, such as a password
- Something you have, such as a phone or security key
- Something you are, such as a fingerprint
Two-factor authentication combines two different types. When you log in from a new device, you enter your password and then confirm with your second factor.
2FA Methods Compared
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| Text message codes | Code sent by SMS | Easy, widely available | Vulnerable to SIM swapping and phishing |
| Email codes | Code sent by email | Easy | Only as secure as your email |
| Authenticator app | App generates time-based codes | Works offline, stronger than SMS | Can still be phished |
| Push prompts | Approve a login on your phone | Convenient | Risk of approving prompts you did not start |
| Hardware security key | Physical key you tap or insert | Strong phishing resistance | Costs money, must not be lost |
| Passkeys | Device-based cryptographic login | Phishing resistant, convenient | Support still growing |
Any 2FA is generally better than none. If a site offers stronger options, use them for important accounts.
A Note on Text Message Codes
SMS codes are better than nothing, but criminals can sometimes take over a phone number through a SIM swap. Ask your mobile carrier about account PINs or port-out protections, and use app-based or hardware methods where available.
Which Accounts to Protect First
- Your main email account, since it can reset other passwords
- Your password manager. See the password manager guide.
- Banking and financial accounts
- Your mobile carrier account
- Cloud storage and photo accounts
- Social media accounts
- Shopping accounts with saved cards
How to Set Up an Authenticator App
- Install an authenticator app on your phone; some password managers include one
- Log in to the account you want to protect
- Go to security settings and find two-factor or two-step verification
- Choose authenticator app
- Scan the QR code shown
- Enter the code the app displays to confirm
- Save the backup codes the site provides
How to Set Up a Security Key
- Check that the account supports security keys
- In security settings, choose to add a security key
- Insert or tap the key when prompted
- Register a second backup key if possible
- Store the backup key somewhere safe
Backup Codes and Recovery
Backup codes let you in if you lose your phone or key. Store them offline, such as printed in a secure place at home, or in your password manager. Without backups, losing your second factor can lock you out.
When you get a new phone, move your authenticator app accounts before wiping the old phone. Many apps have transfer or backup features; check how yours works.
Avoiding MFA Fatigue
Some attackers send repeated push prompts hoping you will approve one. Never approve a login you did not start. If you get unexpected prompts, change your password, since someone may know it.
Passkeys
Passkeys are a newer login method that can replace passwords on supported sites and offer strong phishing resistance. See passkeys explained.
Common Mistakes
- Turning on 2FA without saving backup codes
- Approving prompts you did not start
- Relying only on SMS for critical accounts when better options exist
- Forgetting to transfer authenticator accounts to a new phone
- Giving codes to anyone who calls or texts asking for them
A Note on Shared and Business Accounts
For accounts shared with family members, decide who holds the second factor and how others will get codes. Some password managers can store authenticator codes in shared entries. For small business accounts, avoid tying critical logins to one employee’s personal phone; use security keys or managed authenticators and document recovery steps.
A Note on Recovery Email and Phone
Many accounts let you add a recovery email address and phone number. Keep them current, and make sure the recovery email is itself protected with strong two-factor authentication. Attackers who control a recovery address can often reset the account.
Final Setup Checklist
- Email protected
- Password manager protected
- Financial accounts protected
- Backup codes stored safely
- Recovery options current
Starting Small
Set aside an hour to protect three accounts: email, password manager and your primary bank. Save backup codes for each before moving on. Add other accounts gradually as you log in to them over the following weeks.
A Note on Trusted Devices
Many sites let you mark a device as trusted so you are not asked for a second factor each time. Use this only on personal devices you control, never on shared or public computers.
Frequently Asked Questions
Is SMS 2FA better than nothing?
Yes, though stronger methods are preferable where available.
What if I lose my phone?
Use backup codes or a backup method to log in, then update your settings.
Should I use a hardware key?
They offer strong protection, especially for high-value accounts.
Will a company ever ask for my 2FA code?
Legitimate companies generally do not call asking for login codes. Treat such requests as a scam. See phishing red flags.
Can my password manager store 2FA codes?
Some can. Consider whether you want both factors in one place.
The Bottom Line
Turn on two-factor authentication for your most important accounts, prefer authenticator apps, security keys or passkeys, save backup codes and never share codes or approve unexpected prompts.
Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.