Practical guide · verified against the real thing
Two-factor authentication, done right
In one line: Why 2FA beats any password, the three ways to get it (SMS, app, passkey) ranked honestly, and the backup codes that save you.
Two-factor authentication means a login needs something you know (your password) and something you have (your phone, an app, a security key). Its value is blunt: a stolen password alone stops working. Accounts with 2FA are dramatically harder to take over — which is why every serious security body pushes it, and why enabling it on your email first matters more than anywhere else, because email is the reset door to everything else.
The three ways, ranked honestly
SMS codes are the weakest but still worthwhile — better than nothing, vulnerable to SIM-swap attacks where a fraudster moves your number to their SIM. Authenticator apps (Google Authenticator, Authy, Aegis and similar) generate codes on the device itself; no network, nothing to intercept — the sensible default. Passkeys are the newest: a cryptographic key stored on your device, unlocked with fingerprint or PIN, with nothing typeable to phish. Where a service offers passkeys, they are the best option for most people.
Set it up in five minutes
Go to the account's security settings — look for "two-step verification", "2FA" or "security". Choose an authenticator app, scan the QR code it shows, and type back the six-digit code to prove the pairing worked. Do this for email first, then banking, then social.
The step everyone skips
The service will show you backup codes — a list of one-time codes for when your phone is lost, dead or reset. Save them somewhere that is not the phone doing the authenticating: printed, or in the password manager itself. Skipping this is how people lock themselves out, and lockouts teach the wrong lesson.
What 2FA does not fix
It protects logins, not judgement. A payment you authorise yourself, or a conversation you paste into a tool — see what assistants do with your data — is outside its reach. And if a service offers to send a login link by email instead, that is fine too: possession of your inbox is the factor.
The ten-minute shortlist
Email, bank, password manager, primary social, cloud storage. Five accounts tonight beats a perfect plan for next month.
Sources
Next