A strong password is a good start, but passwords are leaked, guessed and phished every day. Two-factor authentication (2FA) adds a second check so a stolen password alone is not enough.
The three kinds of second factor
- Authenticator app. An app on your phone shows a code that changes every 30 seconds. This is the best balance of safety and convenience.
- SMS code. A code is texted to you. It is better than nothing, but a SIM swap can intercept it, so prefer an app where possible.
- Security key. A small physical device you plug in or tap. This is the strongest option for important accounts.
Where to turn it on first
Start with the accounts that can reset all the others: your email, then your banking and payment accounts, then social media and your online stores.
How to set up two factor authentication
- Open the security settings of the account and choose two-factor or two-step verification.
- Scan the QR code with an authenticator app.
- Save the backup codes somewhere safe and offline.
- Test it by signing out and in again.
Common mistakes
- Keeping backup codes in the same inbox that 2FA protects.
- Approving a login prompt you did not start.
- Reusing one password across several sites.
2FA checklist for everyday accounts
- Turn on two factor authentication for your main email account first because email often controls password resets for other services.
- Use an authenticator app or security key when a service offers those options and they fit your needs.
- Store recovery codes somewhere separate from the account they protect.
- Review active sessions and remove devices you no longer recognize.
- Never approve an unexpected login prompt or give a one-time security code to another person.
Why 2FA still needs good passwords
Two factor authentication is an additional layer, not a replacement for a strong password. Use a unique password for every important account and consider a reputable password manager so you do not have to reuse credentials.
Also keep your recovery email and phone number secure. If an attacker can control your recovery method, they may still be able to reset an account even when 2FA is enabled.
Summary
Spend ten minutes turning on 2FA for your email and money accounts today. It is one of the most effective security steps you can take.