In this article
Imagine someone gets hold of your email password. Without extra protection, they can log in immediately and reset the passwords of your other accounts. Two-factor authentication adds a second door that only opens with something you alone have.
What is two-factor authentication?
It is a verification method that requires two different factors to sign in: something you know, such as a password, and something you have, such as your phone or a security key. Even if an attacker knows your password, they cannot get in without the second factor.
Types of two-factor authentication
1. SMS text messages
You receive a code by text when signing in. It is better than nothing, but it is the weakest option, because messages can be intercepted or your number can be moved to another SIM by tricking your mobile carrier.
2. Authenticator apps
Apps generate a 6-digit code that changes every 30 seconds and work even offline. They are a balanced, secure choice for most people.
3. Physical security keys
Small devices you plug into your computer or tap against your phone. They are the strongest option because they resist phishing pages, and they suit very sensitive accounts.
4. Passkeys
A newer technology that replaces the password with your fingerprint, face or device PIN. Many major services support it, and it is phishing-resistant by design.
Where to start
Rank your accounts by importance and start with these:
- Your main email, because it is the key to recovering everything else.
- Bank accounts and payment wallets.
- Your store and the marketplaces you sell on.
- Hosting and domain name.
- Your business social media accounts.
Don’t lose access to your accounts
Most people worry about losing their phone. To avoid problems:
- Save the recovery codes the service gives you when enabling 2FA in a safe place, such as a password manager or a sheet of paper kept securely.
- Add more than one verification method if possible.
- Use an authenticator app that supports encrypted backup.
2FA does not replace a strong password
The two work together. Keep using long, unique passwords for every account; you can create them with our strong password generator.
Summary
Enabling two-factor authentication takes a few minutes per account and stops a large share of break-in attempts. Start today with your email, then move on to your other important accounts.
