Two-Factor Authentication Explained: SMS, Apps, Keys and Passkeys
Even a perfect password can be stolen by a phishing page or leaked in a breach. Two-factor authentication (2FA) adds a second check, so a stolen password alone isn’t enough to get into your account. It is one of the most effective security steps you can take, and it takes about two minutes per account to set up.
What “two factors” means
Authentication factors fall into three groups:
- Something you know: a password, PIN or passphrase.
- Something you have: your phone, an authenticator app or a hardware security key.
- Something you are: a fingerprint or face scan.
2FA (or multi-factor authentication, MFA) combines at least two different groups. An attacker in another country who has your password still doesn’t have your phone.
The main types of 2FA, compared
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| SMS codes | A one-time code is texted to your number | Works on any phone; easy | Vulnerable to SIM-swap fraud and phishing pages that relay the code |
| Authenticator app (TOTP) | An app generates a new 6-digit code every 30 seconds | Works offline; not tied to your SIM | Can still be phished by a fake site in real time; back up your codes |
| Push approval | Your phone asks “Is this you?” | Convenient | “MFA fatigue” attacks spam prompts until someone taps Approve |
| Security key (FIDO2/U2F) | A small USB/NFC key you tap to sign in | Resistant to phishing: the key checks the real website address | Costs money; you need a backup key |
| Passkeys | A cryptographic key stored on your device or password manager, unlocked with your fingerprint, face or PIN | Phishing-resistant, no password to steal, fast | Not yet supported by every site; recovery depends on your device ecosystem |
Which should you choose?
- Anything is better than nothing. SMS 2FA still blocks the vast majority of automated attacks.
- Prefer an authenticator app over SMS where available, especially for email and financial accounts.
- Use passkeys or security keys for your most valuable accounts, such as email, password manager and cloud storage, if the service supports them. They’re the only common methods that stop phishing outright.
Setting it up without locking yourself out
- Open the account’s Security or Sign-in settings and look for “2-Step Verification”, “Two-factor authentication” or “Passkeys”.
- Follow the steps: scan the QR code with your authenticator app or register your key or passkey.
- Save the backup / recovery codes the site shows you. Print them or store them in your password manager. They’re your way back in if you lose your phone.
- Add a second method if offered (for example a backup key or a second device).
Common questions
Does 2FA mean my password doesn’t matter?
No. 2FA is a second layer, not a replacement. A weak or reused password still exposes you to targeted attacks and makes recovery harder. Keep using unique, generated passwords. Our password generator and passphrase generator make that easy.
What happens if I lose my phone?
Use one of your saved backup codes to sign in, then remove the old device and set up 2FA on your new one. This is why saving backup codes is the most important step.
Someone is asking me for an OTP. Is that normal?
Never share a one-time code with anyone, including people claiming to be from your bank, a delivery company or customer support. A code is only ever meant to be typed into the official app or website you opened yourself.