Two-Factor Authentication, Explained Simply

If you could make only one security change this year, it should be this one. Two-factor authentication, often called 2FA, adds a second step to your login. Even if someone steals or guesses your password, they still cannot get in without that second factor.

How it works When you sign in, the service asks for your password and then for a second proof that it is really you. That proof is usually something you have, such as your phone or a security key.

The main options, from good to best

• SMS codes: better than nothing, but vulnerable to SIM swapping and interception.
• Authenticator apps: generate a fresh code every 30 seconds on your phone. A strong default for most people.
• Push approvals: a prompt on your phone asking you to approve the login. Only approve what you started yourself.
• Passkeys and security keys: the strongest option, and highly resistant to phishing because they only work on the real website.

Where to turn it on first

• Your main email account, because it can reset almost everything else.
• Banking and payment accounts.
• Cloud storage and business tools.
• Social media and your website admin panel.

Don’t skip the backup codes When you enable 2FA, most services give you backup codes. Store them in your password manager or a safe place. They are your way back in if you lose your phone.

A ten-minute task with years of protection Setting up 2FA on your most important accounts takes less time than a coffee break, and it blocks a large share of account takeover attempts. Start with your email today.