Passwords alone aren’t enough anymore. Billions of them have leaked in data breaches, and attackers can test stolen passwords against thousands of sites in minutes. The simplest way to stop most account takeovers is two-factor authentication, usually called 2FA.
This guide explains what 2FA is, which method you should use and exactly how to turn it on for your most important accounts. It’s one of the core steps in our wider guide on how to protect your online privacy.
In this article
What Is Two-Factor Authentication?
Two-factor authentication means proving who you are in two different ways when you log in. Security experts group these proofs into three types:
Also readHow to Free Up Disk Space on Windows 11: 12 Safe Ways I Use on Every PC
- Something you know: a password or PIN
- Something you have: your phone, a security key or an authenticator app
- Something you are: your fingerprint or face
2FA combines two of these, usually your password plus a code from your phone. So even if a hacker steals your password, they still can’t get into your account without your phone. The US Cybersecurity and Infrastructure Security Agency recommends turning it on everywhere; you can read its guidance on the CISA MFA page.
You may also see the term MFA (multi-factor authentication). It means the same idea and can include more than two factors.
The Main Types of 2FA, Ranked by Security
| Method | How it works | Security level |
|---|---|---|
| Hardware security key | Plug in or tap a physical key (e.g., YubiKey) | Highest |
| Passkey | Phone’s face, fingerprint or PIN | Very high |
| Authenticator app | 6-digit code that changes every 30 seconds | High |
| Push notification | Tap “Yes, it’s me” on your phone | Good |
| SMS code | Code sent by text message | Basic |
| Email code | Code sent to your inbox | Basic |
Why SMS Codes Are the Weakest Option
SMS 2FA is far better than nothing, but it has real weaknesses:
- SIM swap attacks: Scammers trick your carrier into moving your number to their SIM, then receive your codes.
- Phishing: Fake login pages can ask for your SMS code and use it instantly.
- Coverage issues: No signal means no code, which is a problem when traveling.
If a service offers an authenticator app or passkey, choose that instead.
The Best Authenticator Apps in 2026
Authenticator apps generate codes offline on your phone. Popular, trustworthy options include:
- Google Authenticator: Simple and now supports cloud backup.
- Microsoft Authenticator: Great for Microsoft and work accounts, with backup built in.
- Authy: Multi-device support.
- Built-in password managers: Apple Passwords, 1Password and Bitwarden can store 2FA codes too.
If you already use a password manager, check whether it handles 2FA codes. Our guide to the best password manager apps notes which ones do.
How to Set Up 2FA on Popular Accounts
Google / Gmail
- Go to myaccount.google.com > Security.
- Select 2-Step Verification and tap Get started.
- Add your phone, then add an authenticator app or passkey as your main method.
- Save the backup codes Google gives you.
Apple ID
Apple turns on 2FA by default for most newer accounts. To check, go to Settings > [Your Name] > Sign-In & Security on your iPhone. Make sure a trusted phone number is listed and consider adding a recovery contact.
- Open Settings > Account > Two-step verification.
- Tap Turn on and create a six-digit PIN.
- Add an email address in case you forget the PIN.
Instagram and Facebook
- Open Accounts Center > Password and security > Two-factor authentication.
- Choose the account and select Authentication app (recommended).
- Scan the code with your authenticator app and enter the six-digit code to confirm.
Microsoft and Outlook
- Sign in at account.microsoft.com > Security.
- Open Advanced security options and turn on two-step verification.
- Link Microsoft Authenticator for one-tap approvals.
Banking Apps
Most banks now enable 2FA by default through their app. Check your bank’s security settings and turn on biometric login and transaction alerts where available.
Don’t Skip Backup Codes
The biggest fear with 2FA is losing your phone and getting locked out. Backup codes solve this. When you set up 2FA, most services give you a set of one-time recovery codes.
- Save them in your password manager.
- Or print them and keep them somewhere safe.
- Never store them in a screenshot in your camera roll.
Also, when you get a new phone, transfer your authenticator app before wiping the old one. If you’re switching phones soon, our eSIM guide covers moving your mobile number safely too.
What About Passkeys?
Passkeys combine convenience and security. Instead of a password plus a code, you simply confirm with your fingerprint or face. Because a passkey only works on the real website, it can’t be phished. The FIDO Alliance, which created the standard, lists the growing number of supported services.
If a site offers passkeys, they’re often the best choice for most people.
Which Accounts to Protect First
If you’re short on time, prioritize in this order:
- Primary email: It’s the key to resetting every other password.
- Banking and payment apps
- Apple ID or Google account
- Social media and messaging
- Work and cloud storage accounts
Final Thoughts
Two-factor authentication takes a few minutes per account and blocks the vast majority of automated hacking attempts. Start with your email today, use an authenticator app or passkey where possible, and keep your backup codes safe.
Frequently Asked Questions
Is 2FA really necessary? Yes. It’s one of the most effective ways to stop account takeovers.
What happens if I lose my phone? Use your backup codes or recovery options to sign in, then set up 2FA on your new phone.
Is 2FA the same as MFA? 2FA is a type of MFA that uses exactly two factors.
4 Comments