Two-Factor Authentication, in Plain Terms

A password is one thing you know. Two-factor authentication adds a second requirement, so that knowing the password is no longer enough to get in.

It is the single most effective account protection available, and setting it up takes a few minutes per account.

What it actually protects against

A stolen or guessed password. The most common way accounts are compromised, and the second factor stops it dead.

A password exposed in a breach. Breaches happen constantly, and reused passwords mean one breach opens many accounts. The second factor limits the damage.

A phishing attempt, partly. Someone who captures your password still needs the second factor — though some phishing captures codes too, which is why the strongest methods matter.

What it does not protect against: malware already on your device, someone with physical access to an unlocked machine, or an account recovery process weaker than the login.

The methods, weakest to strongest

Text message codes

Better than nothing, and the weakest option.

The weakness: someone who persuades your mobile provider to transfer your number to their SIM receives your codes. This is a known and used attack, and it succeeds more often than it should.

Use it where nothing better is offered, and prefer something better where it is.

Email codes

Similar weakness. If someone has your email, they have this. And email is frequently the account being protected.

Authenticator apps

The sensible default for most people.

How it works: an app on your phone generates a six-digit code that changes every thirty seconds. The service and the app share a secret established at setup, and both compute the same code independently.

Why it is better: the code never travels anywhere. There is nothing to intercept and no provider to deceive.

It works offline, because the code is computed from the time and the shared secret rather than received.

Choose an app that backs up to another device or an account, or you will need to reconfigure every account when you change phone.

Push approvals

A notification asking whether you are signing in. Convenient, and vulnerable to approval fatigue — repeated prompts until someone accepts one to make them stop.

If your service shows a number to match, that is a meaningfully stronger version.

Never approve a prompt you did not trigger, and if they keep arriving, your password is compromised and needs changing immediately.

Hardware keys

The strongest option, and the one that genuinely defeats phishing.

A small physical device you plug in or tap. It verifies the site's identity cryptographically, so a fake site cannot capture anything usable.

Cost: modest, and you need two — one for use and one kept safe as a backup.

Worth it for email, financial accounts, and anyone at elevated risk.

Passkeys

Where things are heading. A cryptographic key on your device, unlocked by fingerprint, face or PIN, replacing the password entirely.

Nothing to remember, nothing to type, nothing phishable.

Enable where offered, particularly on important accounts. See passwords: what changed.

Which accounts first

Email, before anything else. Email resets every other account. Someone with your email has everything else, whatever those accounts are protected with.

Then anything holding money — banking, payment services, shopping accounts with stored cards.

Then your password manager, which holds the keys to everything.

Then accounts holding personal data — cloud storage, photographs, health, government services.

Then social accounts, which matter for impersonation.

Then everything else, as you encounter it.

Not locking yourself out

The most common reason people avoid this, and it is entirely preventable.

Save the recovery codes. Every service offers a set at setup. Print them, or store them somewhere secure that is not the device generating your codes.

Register more than one method where the service allows — an app plus a phone number, or two hardware keys.

Back up your authenticator app, or record the setup keys.

Before changing phone, migrate your authenticator first. Most apps have a transfer process; using it beforehand is far easier than recovering afterwards.

Keep your recovery email and phone current. An account recoverable through an address you no longer control is an account you will lose.

If you do get locked out, most services have a recovery process. It is slow and it usually works, so it is a delay rather than a disaster.

Practical points

Do not screenshot the setup QR code and leave it in your photographs. That image is the secret.

Trusted device options reduce how often you are asked. Convenient, and only use them on devices genuinely under your control.

Codes are time-based, so a phone with a badly wrong clock produces codes that fail. Set the time to automatic.

One authenticator app can hold all your accounts — you do not need one per service.

If a code is rejected repeatedly, check the time, and check you are entering the right account's code.

Helping someone else set it up

Start with email. Highest value, and it demonstrates the pattern.

Set up the authenticator app on their phone together, and make sure they understand what a prompt means — that approving one they did not trigger is how accounts are lost.

Print the recovery codes and put them somewhere they and one trusted person can find.

Explain the number-matching prompt if their service uses one, because that is the defence against approval fatigue.

The short version

A second factor stops a stolen password from being enough, which covers the most common way accounts are compromised.

An authenticator app beats text messages, which can be defeated by transferring your phone number.

Email first, because email resets everything else.

Save the recovery codes somewhere separate, and migrate your authenticator before changing phone.

And never approve a prompt you did not trigger — repeated prompts mean your password is already compromised.

For practical baseline security guidance for home users, see CISA Secure Our World.