A password alone is one lock on your door. Two-factor authentication adds a second lock, and a thief needs both. This beginner's guide is part of our password basics series.
What 2FA means
There are three kinds of proof, or factors:
- Something you know, such as a password.
- Something you have, such as your phone.
- Something you are, such as your fingerprint.
Two-factor means using two different kinds. A password and a security question do not count, since both are things you know.
How it works when you log in
- You type your password as usual.
- The site asks for a second proof.
- You enter a code from your phone, or tap to approve.
- You are in.
A criminal with your stolen password gets stuck at step two.
Why it matters so much
Passwords leak through data breaches and fake websites, however careful you are. Two-factor login means that a stolen password alone is not enough to get in. The US agency CISA recommends it for all important accounts.
Types of 2FA
| Type | Strength |
|---|---|
| Text message code | Better than nothing |
| Authenticator app | Good, and free |
| Security key | Very strong |
| Passkey | Very strong, and replaces the password |
Read 2FA methods compared for more detail.
Where to turn it on first
Start with your email, because it can reset your other accounts. Then move on to your password manager, bank and social media. Our list of which accounts need 2FA first gives the full order.
How to turn it on
Look in your account's settings for Security, then two-factor authentication or two-step verification. Most people start with an authenticator app. Save your backup codes as you do this.