However strong, a password is only 'something you know' — once leaked, it's worthless. Two-factor authentication (2FA) adds 'something you have' on top, so even a stolen password won't let an attacker in.
Three types of 2FA, with different strengths
- SMS codes: lowest barrier, but vulnerable to SIM-swap or phishing interception — the weakest;
- Authenticator apps (TOTP): Google Authenticator, Authy, etc. generate codes offline with no network dependency — the recommended default;
- Hardware keys (FIDO2 / YubiKey): a physical device with the strongest phishing resistance, ideal for high-value accounts.
Avoid SMS-only where you can
A SIM can be hijacked via a social-engineered 'port-out,' and SMS codes can be relayed in real time by a phishing page. If you can use an authenticator app or a hardware key, don't rely on SMS.
How to use it well
- Enable 2FA first on 'primary' accounts like email, payments, and cloud storage;
- Prefer an authenticator app over SMS;
- Always save your backup codes and migrate the authenticator before switching phones;
- Email is the root of all recovery — give it the strongest tier of 2FA.
2FA doesn't replace strong passwords; it complements them: a password manager handles 'a unique strong password per site,' 2FA handles 'no entry even if the password leaks.' Stacked, they form a complete account defense.