What is Two-Factor Authentication and Why You Need It
Two-factor authentication is the single most effective thing you can do to protect your accounts. Here's exactly how it works and how to set it up.
What it is
Two-factor authentication (2FA) requires two separate proofs of identity to log into an account: something you know (your password) and something you have (your phone, a hardware key, or an authenticator app). Even if an attacker has your password, they can't access your account without the second factor.
It's the single most effective security control available to regular users. Microsoft's research found that accounts with 2FA enabled are 99.9% less likely to be compromised than accounts without it.
Types of 2FA — ranked by security
Hardware security keys (best) — Physical devices like YubiKey that you plug in or tap. Immune to phishing attacks. Overkill for most users but the right answer for high-value accounts.
Authenticator apps (recommended) — Apps like Google Authenticator, Authy, or the authenticator built into 1Password generate time-based codes that expire every 30 seconds. Much more secure than SMS.
SMS text messages (acceptable but not ideal) — A code sent to your phone number. Vulnerable to SIM swapping attacks where an attacker convinces your carrier to transfer your number to their device. Better than nothing, but upgrade to an authenticator app when possible.
Email codes (weakest) — A code sent to your email. Only as secure as your email account itself.
Where to enable it first
Prioritize accounts in this order: email (most important — controls password resets for everything else), financial accounts, social media, and then everything else. Most major services support 2FA in their security settings.
What about losing your phone?
Every service that offers 2FA also provides backup codes — a set of one-time codes you can use if you lose your device. Save these somewhere secure: printed and locked away, or in a password manager vault. This is the step most people skip and later regret.
The bottom line
Enable 2FA on your email account today. It takes five minutes and eliminates the most common account takeover attack. Use an authenticator app rather than SMS when given the choice.
A password manager with built-in 2FA support makes this even easier →