Two-factor authentication, explained without the jargon
By Abdullah Chattha ·
A password proves you know something. Two-factor authentication, usually shortened to 2FA, adds a second proof — something you have, like your phone, or something you are, like a fingerprint — so that a stolen password alone isn't enough to get into your account.
Why it matters
Passwords leak constantly, through data breaches, phishing pages, and reused logins across sites. 2FA doesn't stop your password from leaking, but it stops that leak from being enough on its own. It's one of the highest-value security changes an average person can make, and it usually takes a few minutes per account.
The common methods
- Authenticator apps — generate a rotating six-digit code on your device. Not tied to your phone number, which makes them harder to intercept than SMS.
- SMS codes — simple and widely supported, but vulnerable to SIM-swapping attacks. Better than nothing, but not the strongest option available.
- Hardware security keys — a physical device you plug in or tap. The strongest common option, and increasingly easy to set up.
- Passkeys — a newer, passwordless approach that combines both factors into one step using your device's built-in security.
Where to start
Prioritize accounts that unlock everything else: your primary email, your password manager, and any account tied to financial access. Turn on 2FA there first, ideally with an authenticator app or a hardware key rather than SMS, then work outward to everything else over time.
One habit worth building
Save your backup codes somewhere offline and separate from the device you use day to day. Losing access to your second factor without a backup is the most common way people lock themselves out of their own accounts.