Two-Factor Authentication (2FA)

Two-factor authentication, or 2FA, is an account-security method that requires two forms of verification before access is granted.

The idea is simple: a password alone, however strong, is only one thing standing between an attacker and your account. 2FA adds a second, different thing, so that even if someone learns your password, they still cannot get in without the second factor. It is one of the most effective single steps you can take to protect important accounts.

The 'two' refers to two different types of evidence, ideally from different categories. The first is usually something you know — your password. The second is something you have or something you are: a code from an app, a tap on a security key, a text message code, or a fingerprint or face scan. Because an attacker would need to compromise two different kinds of thing at once, the account becomes far harder to break into.

Common second factors vary in strength. Authenticator apps (such as those generating a fresh six-digit code every 30 seconds) are convenient and strong. Security keys — small physical devices you tap or insert — are among the strongest options and are very resistant to phishing. SMS codes (sent by text message) are better than nothing but weaker, because text messages can sometimes be intercepted or redirected. Wherever a stronger option is offered, it is usually worth choosing.

It is just as important to plan for the day you lose your second factor — a lost phone, a broken key, a new device. Most services provide recovery methods: backup codes to print and store safely, or a second trusted device. Setting these up when you enable 2FA, rather than during an emergency, is what turns a lost phone from a crisis into a mild inconvenience.

2FA meaningfully improves security, but it does not make an account completely invulnerable. A determined attacker can still try to phish both factors at once, and recovery methods can themselves be a weak link if they are poorly protected. The aim is not perfection but a large, practical reduction in risk — enough to stop the overwhelming majority of automated and opportunistic attacks in their tracks.

For your most important accounts — email, banking, anything that can be used to reset other passwords — 2FA is well worth enabling. For convenience, you might also look at passkeys, which can offer a similar level of protection with less friction than a code.