Two-factor authentication: a plain-language guide

Two-factor authentication (2FA) means logging in requires, besides something you know (the password), something you have (like your phone). If the password leaks, an attacker still can't get in without the second step.

Why it matters

Passwords leak constantly — through breaches, phishing and guessing (password guide). 2FA is the second layer that turns most of those leaks into dead ends.

The three common methods

1. SMS codes. The code arrives by text. Simple and works on every phone. Weakness: SMS can be intercepted or redirected with a SIM-swap trick, and it depends on network coverage. Better than nothing, not ideal.

2. Authenticator apps. An app on the phone (Google Authenticator, Microsoft Authenticator, Aegis…) generates 6-digit codes that change every 30 seconds. Works offline and resists SIM swap. This is the best balance for most people.

3. Hardware keys (FIDO2/USB). The strongest defense against phishing, because the key only works on the genuine site. Costs money; sensible for very important accounts.

Where to start

Priority order: 1) your main email (it's the recovery path for everything else), 2) banking and financial accounts, 3) social media and work accounts, 4) the rest.

Setup steps (general)

• Open the account's security settings.
• Find and enable "two-step verification".
• Choose a method — preferably an authenticator app.
• Save the recovery codes somewhere that is not the same phone (printed or in the password manager).
• Test the login once.

Common mistakes

• Not saving recovery codes; lose the phone, lose the account.
• Approving every login prompt that appears; if you didn't try to log in, deny it and change the password.
• Typing codes into a page opened from a suspicious message link; open sites by typing the address or from your own bookmarks.

Common questions

What if I lose my phone? You log in with the recovery codes or a registered backup method — which is exactly why saving the codes is critical.

Does 2FA stop all hacking? Not everything, but it neutralizes most common attacks. Advanced phishing can still steal codes; a hardware key resists that.