Quick answerTwo-factor authentication (2FA) adds a second check, such as a code from an app, after your password, so a leaked password alone can't open your account. Passkeys and authenticator apps are the strongest common options; SMS codes are better than nothing but vulnerable to SIM swaps. Turn it on first for your email, WhatsApp, banking and social media.
Your email account is the master key: whoever controls it can reset almost every other password. Two-factor authentication means that even if your password leaks in a breach, an attacker still needs your phone or security key.
The options, strongest first
- Passkeys and security keys: phishing-resistant, nothing to type. Supported by Google, Microsoft, Apple, WhatsApp and a growing list of sites.
- Authenticator apps (Google Authenticator, Microsoft Authenticator, Aegis, 2FAS): a 6-digit code that changes every 30 seconds, generated on your phone.
- Push prompts ("Is this you trying to sign in?"): convenient, but never approve a prompt you didn't trigger.
- SMS codes: better than nothing, but vulnerable to SIM swap and to being read out to scammers.
Where to turn it on first
- Email: Google Account → Security → 2-Step Verification, or Microsoft account → Security → Advanced security options.
- WhatsApp: Settings → Account → Two-step verification.
- Instagram and Facebook: Accounts Center → Password and security → Two-factor authentication.
- Banking and wallet apps: enable app PIN, biometric login and transaction alerts.
Save your backup codes
When you enable 2FA, most services give you backup codes. Save them in your password manager or print them and keep them somewhere safe. They are how you get back in if you lose your phone.
Frequently asked questions
Is SMS two-factor authentication safe?
It's much safer than a password alone, but it can be defeated by SIM swaps and social engineering. Use an authenticator app or passkey for your most important accounts.
What happens to my 2FA if I lose my phone?
Use the backup codes you saved, or a second registered method. Many authenticator apps can also back up codes to your account.